66.9.173.125📋 Copy

# IP Intelligence Briefing: 66.9.173.125/32

Classification: Moderate Risk | Date: 2026-07-31 | Status: Active

## Executive Summary

IP 66.9.173.125 exhibits a moderate risk profile (score 50) with evidence of DNSBL listings and control plane instability. The address resolves to Starlink infrastructure and demonstrates no active services. The /24 neighborhood maintains low abuse density, suggesting isolated risk rather than coordinated activity.

## Technical Profile

Network Classification:

• Risk Score: 50 (Moderate Risk)
• Operator Score: 0.2174 (Minimal)
• Control Plane: Origin ASN 14593, BGP Prefix 66.9.173.0/24
• Routing Stability: Unstable (isRouteStable: false)

Geolocation & Ownership:

• PTR Resolution: customer.jhngzaf1.isp.starlink.com
• ASN History: AS18885 (m2ngage telecommunications ii corp.)
• Country: US
• Network Role: Firewalled / No Services (no open ports detected)

DNS Analysis:

• Forward Resolution: Confirmed (1 record)
• Email Authentication: SPF and DMARC configured
• DNSBL Status: Listed on 2 of 8 total blacklists
• DNSSEC: Valid | CAA Records: Present

## Historical Analysis

Observation Timeline: 11 signals recorded through 2026-07-31

Key temporal indicators:

• Blacklist activity observed with maximum severity "high"
• Control plane data shows routing instability over the observation period
• No persistent malicious patterns detected (threatPersistenceDays: 0)
• Ownership changes: None recorded

Risk Evolution: The IP has maintained a moderate risk posture without escalating threat patterns. No campaigns or correlated activity detected.

## Relationship Graph

Associated Entities:

• DNS Association: customer.jhngzaf1.isp.starlink.com
• No additional organizational, subnet, or certificate relationships identified

## Neighborhood Analysis

Subnet: 66.9.173.0/24

Risk Distribution:

• High Risk IPs: 0
• Medium Risk IPs: 0
• Low Risk IPs: 6
• Abuse Density: 0%

Sibling IP Risk Scores:

The /24 subnet demonstrates low neighborhood abuse density with no high-risk neighbors, supporting the conclusion that 66.9.173.125's risk is isolated.

## Recommended Actions

Mitigation Strategy: Block recommended due to moderate risk score and DNSBL presence.

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 66.9.173.125 -j DROP

# nftables

nft add rule inet filter input ip saddr 66.9.173.125 drop

# pfSense

66.9.173.125/32

```

Cloud Platform Rules:

• Cloudflare WAF: Block with expression `ip.src eq 66.9.173.125`
• AWS WAF: Address `66.9.173.125/32` with description "IPDebrief risk 50"

## Analyst Notes

1. Infrastructure Context: PTR hostname indicates Starlink residential satellite internet infrastructure. No open services detected.

2. Risk Assessment: Moderate risk (50/100) driven by DNSBL listings rather than active threat indicators. The IP is not a known attacker, spam source, or Tor exit node.

3. Monitoring Recommendation: Continue monitoring due to control plane instability and DNSBL presence. No immediate escalation required.

4. Neighborhood Context: The /24 subnet shows low abuse density, suggesting this is an isolated reputation issue rather than part of a broader compromise.

---

*This briefing was generated using IPDebrief intelligence tools. All data points are sourced from IPDebrief analysis and should be validated against additional threat intelligence sources before operational action.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.