74.244.119.114📋 Copy

# IP Intelligence Briefing: 74.244.119.114/32

Classification: Low Risk | Status: Active | Last Updated: 2026-07-29

## Executive Summary

IP 74.244.119.114 is a firewalled residential proxy endpoint associated with Starlink infrastructure. Current risk assessment indicates Low Risk status with no active threat indicators. The IP operates within a clean neighborhood subnet and shows no persistent malicious behavior.

## Technical Profile

• Geolocation: Ghana (Accra, Greater Accra Region) — GPS coordinates: 39.83°N, 98.58°W (confidence: 0.35)
• ASN: 14593 (Starlink) | BGP Prefix: 74.244.118.0/23
• DNS Resolution: customer.lgosnga1.isp.starlink.com (reverse DNS confirmed)
• Network Role: Firewalled / No Services — no open ports detected
• Risk Score: 0 | Abuse Confidence: Not applicable
• Control Plane: Route stability flagged as false; 0 route changes in 30-day window

## Threat Indicators

• Blacklist Status: 0/8 DNSBL listings (historical: 8 total listings)
• Campaign Associations: None detected
• Known Campaigns: No correlations
• Tor/Proxy/VPN: Not identified as Tor exit node, proxy, or known attacker

## Historical Observations (Last 16 Signals)

Recent activity includes:

• 2026-07-29 19:16: Network role classification (residential)
• 2026-07-29 19:15: Port scanning activity detected (multiple ports probed)
• 2026-07-29 19:11: Geolocation signal (US) — inconsistent with Ghana consensus
• 2026-07-29 19:10: ASN 7018 (AT&T Services Inc) association with threat indicators

Threat persistence days: 0 | Ownership changes: 0

## Subnet Context (74.244.119.0/24)

• Classification: Mostly Clean
• Abuse Density: 0.1111 (11.11%)
• Total Siblings: 9 | Active: 3 | Threat: 1
• Neighbor Risk Scores:

- 74.244.119.165, .206, .215: Risk 25 (low-medium)

- 74.244.119.124, .224, .255: Risk 0 (low)

- 74.244.119.27, .87: Risk undetermined

## Recommended Actions

SOC Analyst Guidance:

1. Monitor for outbound connection attempts — IP is firewalled but may initiate connections

2. No blocking required — Current risk profile supports allow-by-default with logging

3. Watch for geolocation inconsistencies (Ghana vs. US signals may indicate spoofing)

4. Correlate with subnet neighbors for potential coordinated activity

Firewall Rules: No immediate action required. Standard logging recommended for inbound connection attempts.

---

*Intelligence generated from IPDebrief analysis. For operational decisions, correlate with additional threat feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.