38.226.110.226📋 Copy

# IP Intelligence Briefing: 38.226.110.226/32

## Executive Summary

IP 38.226.110.226 is classified as Low Risk with a risk score of 25. The address belongs to Cogent Communications, LLC (ASN 28585) within the 38.0.0.0/8 block. Geolocation data indicates Brazil (BR), Ceará, Fortaleza. The IP is currently classified as "clean" with no active threat indicators.

## Ownership & Network Classification

• Organization: Cogent Communications, LLC
• ASN: 28585
• Network Block: 38.0.0.0/8
• Country: Brazil (BR)
• Region: Ceará
• City: Fortaleza
• Network Role: Firewalled / No Services
• Classification: Infrastructure provider network

## Risk Assessment

• Overall Risk Score: 25 (Low Risk)
• Provider Score: 0
• Authority Score: 0
• Stability Score: 0
• Threat Indicators: None detected
• Blacklist Count: 0
• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False
• Abuse Confidence: Not elevated

## Threat Intelligence Indicators

• No malicious activity observed in historical scans
• No known campaigns associated with this IP
• Zero threat feed matches
• DNSBL listed count: 1 (minimal operator score: 0.1304)
• No certificate matches or banner anomalies

## Technical Observations

• Open Ports: None detected (firewalled/no services)
• DNS Resolution: Not confirmed (forward resolution count: 0)
• Email Authentication: No SPF, DMARC, or TXT records
• TLS/HTTP: No TLS certificate, HTTP title, or server banner
• Reverse DNS (PTR): Empty
• BGP Prefix: 38.226.110.0/24
• Route Stability: False
• DNSSEC: Valid

## Neighborhood Analysis

Subnet 38.226.110.226/24 exhibits clean classification:

• Abuse Density: 0
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 0
• Risk Distribution: No high/medium risk neighbors detected

## Historical Observations (Last 15 Signals)

Recent observations indicate consistent low-risk classification:

• Subnet classification remained "clean" across all recent observations
• No ownership changes detected
• No threat persistence indicators
• Geolocation validation: ICMP blocked - unable to validate; distance ~7541.6 km from probe origin
• All recent signals show confidence levels between 0.30-0.85 with no contradictory threat data

## Recommended Actions

No specific firewall rules or blocking recommendations are generated at this time due to the low-risk profile. The IP is classified as firewalled with no active services, suggesting it may be a network infrastructure address rather than an end-host.

SOC Analyst Guidance:

• Monitor for changes in service state or risk score elevation
• No immediate blocking recommended based on current risk profile
• Standard provider network traffic expected; allow-list consideration may apply
• Continue passive monitoring for any emerging threat indicators

## Conclusion

IP 38.226.110.226 presents minimal threat. The address is part of a major Tier-1 backbone provider network (Cogent Communications) with clean neighborhood classification and no active threat indicators. Current operational posture is consistent with normal provider infrastructure activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.