200.189.23.144📋 Copy

# IP Intelligence Briefing: 200.189.23.144

## Executive Summary

IP address 200.189.23.144 is a Starlink Brazil residential satellite internet endpoint located in Brasília, Brazil. The IP carries a moderate risk score of 65/100 despite lacking direct threat indicators. The subnet demonstrates minimal abuse density with no high-risk neighbors detected.

## Ownership and Registration

• Organization: Starlink Brazil Serviços de Internet Ltd
• ASN: 14593
• CIDR Block: 200.189.23.0/24
• RIR: LACNIC
• Abuse Contact: Available via RDAP

## Geolocation

• Country: Brazil (BR)
• Region: Federal District
• City: Brasília
• Coordinates: -14.24°S, -51.93°W
• Geo Plausibility: Validated
• ICMP Validation: Blocked (unable to validate)

## Network Classification

• Infrastructure Type: Residential Satellite
• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• DNS PTR Hostname: customer.brsabra1.isp.starlink.com
• Cloud/Proxy/VPN: No indicators

## Threat Profile

• Risk Score: 65/100 (Moderate Risk)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Threat Persistence: 0 days
• DNSBL Listings: 3 of 8 total lists
• Campaign Correlation: None

## Subnet Analysis (200.189.23.0/24)

• Abuse Density: 0 (Minimal)
• Neighbor Count: 9 sibling IPs
• Risk Distribution: 4 medium-risk, 5 low-risk, 0 high-risk
• Highest Neighbor Risk: 200.189.23.57, 200.189.23.78, 200.189.23.123, 200.189.23.209 (all scoring 40)
• Clean Neighbors: 200.189.23.179, 200.189.23.208 (scoring 0)

## Historical Observations

• Total Signals: 16 observations
• Latest Activity: 2026-07-31
• Ownership Changes: 0
• Threat Observation Count: 0
• Signal Types: Network classification, geolocation inference, ICMP validation, ownership persistence, operator scoring

## Security Recommendations

Based on the elevated risk score of 65/100, the following controls are recommended:

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 200.189.23.144 -j DROP

# nftables

nft add rule inet filter input ip saddr 200.189.23.144 drop

# nginx

deny 200.189.23.144;

```

Cloud Platform Rules

• Cloudflare WAF: Block IP with expression `ip.src eq 200.189.23.144`
• AWS WAF: Add to rule set with addresses `200.189.23.144/32`

Monitoring Actions

• Increase logging verbosity for traffic from this IP
• Review recent activity patterns
• Monitor for behavioral changes consistent with the risk profile

## Intelligence Assessment

The IP belongs to legitimate Starlink residential infrastructure. The elevated risk score (65/100) without direct threat indicators suggests potential anomalous behavior rather than confirmed malicious activity. The subnet environment is clean with no abuse density. The lack of open ports and legitimate DNS association supports the classification as a residential satellite endpoint. Recommended action is monitoring with optional blocking depending on organizational policy and context of observed traffic.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.