148.227.91.58📋 Copy

IPDEBRIEF INTELLIGENCE BRIEFING

Target IP: 148.227.91.58/32

Report Date: 2026-07-22

Classification: MODERATE RISK

---

EXECUTIVE SUMMARY

The target IP address 148.227.91.58 is associated with Starlink Brazil Serviços de Internet Ltd (ASN 14593) and presents a moderate risk profile with an overall risk score of 40. The IP resolves to a Starlink customer hostname but exhibits geolocation inconsistencies between reported sources (Chile vs. Brazil). No active threat indicators or malicious behavior were detected in the current observation window.

OWNERSHIP & NETWORK ATTRIBUTES

The IP belongs to netblock 148.227.91.0/24, registered under Starlink Brazil Serviços de Internet Ltd. The organization operates under ARIN jurisdiction with abuse contact available via RDAP. The subnet shows minimal routing operator score (0.2174) and no persistent malicious threat observation. DNS resolution confirms association with customer.brsabra1.isp.starlink.com.

GEOLOCATION ANALYSIS

Geolocation data presents conflicting signals: primary profile data indicates CL (Chile) with Brasília coordinates, while historical signals show BR (Brazil) with São Paulo references. This discrepancy suggests potential routing inconsistencies or multi-region Starlink infrastructure. Geolocation consensus is marked as true with a single source validation.

THREAT POSTURE

Current threat assessment shows:

• No threat indicators detected
• Zero blacklist entries
• No known campaign associations
• Not identified as Tor exit, known attacker, or spam source
• No open ports or active services detected

NEIGHBORHOOD CONTEXT

Analysis of the 148.227.91.0/24 subnet revealed 18 sibling IPs with the following risk distribution: 0 high-risk, 5 medium-risk, and 9 low-risk addresses. Several neighboring IPs (148.227.91.88, .123, .140, .163, .179) share the same risk score of 40. Subnet abuse density remains at 0, indicating no coordinated malicious activity across the /24.

OBSERVATION HISTORY

Fourteen observation records were retrieved, with the most recent data from 2026-07-22. Historical signals confirm consistent ownership attribution to Starlink Brazil with stable ASN 14593. Geolocation signals show intermittent inconsistencies between CL and BR country codes. No ownership changes or threat persistence patterns were observed.

RECOMMENDED ACTIONS

Based on risk score of 40, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 148.227.91.58 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 148.227.91.58 drop

```

Cloudflare WAF:

```json

{

"description": "Block 148.227.91.58 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 148.227.91.58"

}

}

```

AWS WAF:

```json

{

"Addresses": ["148.227.91.58/32"],

"Description": "IPDebrief risk 40"

}

```

---

ANALYST NOTES

The IP presents moderate risk primarily due to its risk score of 40, but lacks direct threat indicators. The geolocation inconsistency between Chile and Brazil warrants monitoring. No immediate blocking is required absent additional corroborating signals, but the recommended firewall rules provide a precautionary control. The subnet context shows no coordinated malicious activity across sibling IPs.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.