38.148.20.90📋 Copy

# IP Intelligence Briefing: 38.148.20.90/32

Date: 2026-07-31

Classification: Moderate Risk

Assigned Risk Score: 65/100

## Executive Summary

IP address 38.148.20.90 belongs to Sumofiber (ASN 397162) and is assigned to the SUMOFIBER-NET-38-148-0-0-1 block. The IP presents moderate risk with a score of 65/100. No active open ports or services were detected. Geolocation data indicates a claimed location in Ammon, Idaho, but validation metrics show geolocation implausibility (RTT 89.0ms below the 156.8ms minimum required for the claimed 7,839km distance).

## Network Ownership and Classification

• Organization: Sumofiber
• ASN: 397162
• CIDR Block: 38.148.0.0/17
• RIR: ARIN
• Network Classification: Firewalled / No Services
• DNSBL Status: Listed on 3 of 8 total DNS blacklists
• Control Plane: BGP prefix 38.148.16.0/21; route stability flagged as unstable; isRouteStable: false

## Threat Indicators

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Abuse Confidence Score: Not available
• Threat Feeds: No indicators detected
• Known Campaigns: None identified
• Threat Persistence: 0 days

## Neighborhood Analysis (38.148.20.0/24)

• Subnet Abuse Density: 0.25 (mostly clean)
• Inherited Risk: 2
• Total Siblings: 4
• Active Siblings: 1
• Threat Siblings: 1

Neighbor IPs:

• 38.148.20.85 (Risk: 25, Authority: 50)
• 38.148.20.97 (Risk: 25, Authority: 50)
• 38.148.20.98 (Risk: 0, Authority: 50)

## Observation History

Eighteen total observations recorded. Most recent activity dated 2026-07-31. Key observations include traceroute completion (22 hops via Comcast and Zayo networks), geolocation validation failures (RTT violation), and port scan activity. No persistent malicious behavior detected.

## Relationship Graph

Eight relationships identified, all categorized as "Same Network" pointing to SUMOFIBER-NET-38-148-0-0-1. No hostname, certificate, or organization associations detected.

## Recommended Security Actions

Priority: High

Action: Increase logging verbosity and review recent activity from this IP due to elevated risk score (65/100).

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 38.148.20.90 -j DROP

# nftables

nft add rule inet filter input ip saddr 38.148.20.90 drop

# nginx

deny 38.148.20.90;

# pfSense

38.148.20.90/32

# Cloudflare WAF

Block 38.148.20.90 — IPDebrief risk score 65

# AWS WAF

Addresses: ["38.148.20.90/32"]

Description: IPDebrief risk 65

```

## Analyst Notes

The IP shows moderate risk primarily due to elevated risk score and DNSBL listings. Despite the geolocation implausibility, no active threat indicators or known malicious campaigns were identified. The subnet shows low abuse density (0.25) with most neighboring IPs exhibiting low risk profiles. Recommend monitoring rather than immediate blocking, but implement logging and review for suspicious activity patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.