98.97.131.131📋 Copy

# INTELLIGENCE BRIEFING: 98.97.131.131/32

## Executive Summary

IP address 98.97.131.131 is a SpaceX Services, Inc. Starlink infrastructure endpoint operating in São Paulo, Brazil. The IP carries a high risk score (80) despite belonging to a clean subnet with minimal abuse density. The address resolves to a Starlink customer hostname and exhibits DNSBL listings across 4 of 8 security feeds.

## Ownership and Network Classification

• Organization: SpaceX Services, Inc.
• ASN: 14593 (STARLINK-3140-CA-CHCOILX1-IPV4)
• Network: 98.97.131.0/24
• Geolocation: São Paulo, Brazil (BR)
• IP Type: Customer endpoint (Starlink service)
• DNS PTR: customer.brsabra1.isp.starlink.com

## Risk Assessment

• Risk Score: 80 (High Risk)
• Abuse Confidence: Not explicitly scored
• DNSBL Status: Listed on 4 of 8 security feeds
• Threat Indicators: None currently flagged
• Network Classification: No services detected (Firewalled / No Services)

## Key Findings

1. Contradictory Risk Signals: The IP carries an elevated risk score of 80, yet the 98.97.131.0/24 subnet shows zero abuse density with no active threat siblings. This suggests the risk may derive from specific reputation sources rather than active malicious behavior.

2. DNS Reputation: The reverse DNS resolves to a Starlink customer hostname with SPF and DMARC authentication present, indicating legitimate service infrastructure.

3. Route Stability: The BGP route (98.97.130.0/23) is marked as unstable, which could indicate temporary routing changes or infrastructure adjustments.

4. Service Status: No open ports or active services detected, consistent with a firewall-protected customer endpoint.

## Historical Observations

Recent signal history (15 observations as of 2026-07-31) shows:

• Subnet classification maintained as "clean"
• No threat persistence indicators
• No ownership changes detected
• Abuse density remains at zero across neighborhood analysis

## Neighborhood Analysis

The 98.97.131.0/24 subnet contains only 1 sibling IP with zero active threats. Abuse density is 0.0, indicating this is an isolated endpoint rather than part of a compromised infrastructure cluster.

## Intelligence Assessment

This IP represents legitimate Starlink customer infrastructure in Brazil. The high risk score appears to stem from DNSBL listings rather than active malicious activity. No evidence of command-and-control traffic, spam source activity, or known campaign participation was identified. The endpoint is properly authenticated via Starlink's DNS infrastructure with email authentication (SPF/DMARC) in place.

## Recommended Actions

• Allow traffic to/from this IP at the firewall level
• Monitor for any changes in DNSBL status
• No immediate blocking recommended; the IP is classified as legitimate customer infrastructure
• Verify any alerting systems against this IP are correctly configured to avoid false positives

---

*Report generated by IPDebrief Intelligence Platform. Data based on current threat intelligence feeds and network observations.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.