38.65.154.10📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 38.65.154.10/32

Date: July 23, 2026

Analyst: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

The IP address 38.65.154.10 is associated with ENI NETWORKS (ASN 28409) and presents a LOW RISK profile with a risk score of 25. The address is geolocated to Cancun, Mexico (US registration), operates in a firewalled state with no active services, and shows no evidence of active malicious campaigns. However, the IP has 1 DNSBL listing among 8 total lists with high-severity classification, warranting monitoring.

---

## OWNERSHIP & NETWORK CLASSIFICATION

• Organization: ENI NETWORKS
• Network Block: 38.65.152.0/21 (NET-38-65-152-0-1)
• ASN: 28409
• RIR: ARIN
• Registration: Available via RDAP
• Classification: Firewalled / No Services

---

## GEOLOCATION DATA

• Country: United States (US)
• Region: ROO
• City: Cancun
• Coordinates: 39.83°N, 98.58°W
• Confidence: 0.35 (GeoSource: Cymru-Country)
• Accuracy Radius: 2,500 km
• GeoValidation: Not plausible (discrepancy between registration country and geolocation)

---

## THREAT INDICATORS

• Overall Risk Score: 25 (Low Risk)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None detected
• Blacklist Status: 1 DNSBL listing out of 8 total lists (Maximum severity: HIGH)
• Threat Persistence: 0 days
• Is Persistently Malicious: No

---

## NETWORK BEHAVIOR & SERVICES

• Open Ports: None detected
• TLS Certificate: None
• HTTP Service: None
• Server Banners: None
• Network Role: Infrastructure (Firewalled)
• Connection Type: Residential/Infrastructure
• Anycast: No
• Cloud Provider: No
• CDN: No

---

## DNS ANALYSIS

• PTR Hostnames: customer-10.eninetworks.com
• Forward Resolution: 1 hostname (customer-10.eninetworks.com)
• Domain: eninetworks.com
• Email Authentication: SPF (Yes), DMARC (Yes)
• Certificate Authorities (CAA): No records
• Forward Resolution Count: 1

---

## OBSERVATION HISTORY (Last 18 Observations)

Recent activity captured on July 23, 2026:

• 07:06:51 UTC: Network classification signal (confidence 0.30) - Not CDN, not Tor, not VPN
• 07:05:49 UTC: Ownership stability signal (confidence 0.85) - No ownership changes
• 07:03:35 UTC: Geolocation signal (confidence 0.35) - US location inferred
• 07:02:08 UTC: Blacklist signal (confidence 0.85) - 8 total lists, 1 listed with high severity
• 07:02:05 UTC: DNS resolution signal (confidence 0.50) - Resolved to eninetworks.com

Temporal Analysis: No persistent malicious activity detected. Threat observation count: 0.

---

## RELATIONSHIP GRAPH

• Total Relationships: 10
• Same Network: Multiple entries referencing NET-38-65-152-0-1
• DNS Associations: Multiple entries for customer-10.eninetworks.com
• Organizations: None linked
• Certificates: None
• Campaigns: None

---

## NEIGHBORHOOD ANALYSIS (38.65.154.0/24)

• Subnet: 38.65.154.0/24
• Total Sibling IPs: 0 reported
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0.0%
• Risk Distribution: High (0), Medium (0), Low (0)

---

## CONTROL PLANE DATA

• Origin ASN: 28409
• BGP Prefix: 38.65.154.0/24
• RPKI State: Unknown
• IRR Consistency: Unknown
• Route Changes (30d): 0
• Route Stability: False
• MOAS Status: False
• DNSSEC Valid: True
• DNSBL Listed Count: 1 (of 8 total lists)

---

## RECOMMENDED ACTIONS

Risk Score: 25 (Low Risk)

Action Status: No immediate blocking recommended

Given the low risk score (25) and absence of active threat indicators, no firewall rules or blocking actions are currently recommended. However, the following monitoring measures are advised:

1. Monitor DNSBL Listings: Review the single high-severity blacklist listing to determine source and context

2. Track Geolocation Discrepancy: Note the mismatch between US registration and Cancun, Mexico geolocation

3. Watch for Service Changes: Currently firewalled with no services; monitor for any service activation

4. Cross-reference Related Hostnames: Investigate customer-10.eninetworks.com for additional context

---

## INTELLIGENCE ASSESSMENT

This IP address appears to be a legitimate infrastructure endpoint belonging to ENI NETWORKS, likely serving as a customer-facing or backend endpoint (customer-10.eninetworks.com). The absence of open services, combined with a low risk score and lack of active threat indicators, suggests benign operation. The single DNSBL listing requires investigation but does not currently warrant blocking. No immediate threat action is recommended; continue passive monitoring and observe for any behavioral changes.

---

End of Briefing

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.