38.210.167.147📋 Copy

# IP Intelligence Briefing: 38.210.167.147/32

Date: 2026-07-29

Classification: Moderate Risk

Risk Score: 40/100

## Executive Summary

IP 38.210.167.147 is a Cogent Communications infrastructure IP assigned to Costa Rica (San José) with a moderate risk profile. The address is currently firewalled with no active services and exhibits minimal threat indicators. However, the IP is listed on two DNS blacklists with high severity ratings, warranting defensive monitoring.

## Infrastructure Profile

• Organization: Cogent Communications, LLC
• ASN: 266853 (COGENT-A)
• CIDR Block: 38.0.0.0/8
• Geolocation: Costa Rica, San José (2,500 km accuracy radius)
• Network Role: Provider/Infrastructure
• Service Status: Firewalled / No Services

## Threat Assessment

Current Risk Indicators:

• Listed on 2 of 8 DNS blacklists (high severity)
• No active threat campaigns detected
• Not a Tor exit node, known attacker, or spam source
• No known associated campaigns

Temporal Indicators:

• Route stability: Unstable (route changes in 30-day period)
• Ownership persistence: No changes observed
• Threat observation count: 0
• Not persistently malicious

## Technical Observations

• DNS: Reverse PTR record 38-210-167-147.reverse.metrocom.cr; forward resolution confirmed
• DNSSEC: Valid
• Open Ports: None detected
• TLS/HTTP: No active services
• Email Reputation: N/A (no hosted domains)

## Neighborhood Analysis

• Subnet: 38.210.167.0/24
• Abuse Density: 0%
• Threat Siblings: 0
• Classification: Clean neighborhood with no sibling abuse activity

## Relationship Graph

• DNS Associations: 38-210-167-147.reverse.metrocom.cr (duplicate entries)
• Network Associations: COGENT-A (same network)

## Observation History Summary

15 observations recorded. Most recent signals (2026-07-29) indicate:

• DNSSEC validation successful
• DNS resolution to metrocom.cr domain
• Geolocation signals from US (39.83, -98.58) with low confidence (0.35)
• DNS blacklist listings with high severity ratings

## Recommended Actions

1. Monitor DNSBL Listings: Track the two high-severity blacklist entries

2. Route Change Monitoring: Investigate unstable routing in 38.210.167.0/24

3. Geolocation Discrepancy: Note conflicting location signals (CR vs. US); flag for further investigation if activity patterns suggest origin mismatch

4. Defensive Rules: No immediate firewall rules required; maintain monitoring on blacklist status

## Conclusion

This IP presents moderate risk primarily due to DNS blacklist listings. The infrastructure appears legitimate (Cogent Communications provider) with no active malicious services. Continue monitoring for changes in blacklist status or routing behavior.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.