108.62.56.247📋 Copy

INTELLIGENCE BRIEFING: 108.62.56.247/32

Classification: Moderate Risk | Date: Current | Priority: Medium

---

EXECUTIVE SUMMARY

IP address 108.62.56.247 is a residential or hosting IP assigned to LeaseWeb USA, Inc. Seattle (ASN 396190). The address carries a moderate risk score of 50/100 and shows no active threat indicators, but the parent subnet demonstrates elevated abuse density (0.3828) with 98 malicious siblings out of 256 total addresses.

---

OWNERSHIP & GEOLOCATION

• Organization: LeaseWeb USA, Inc. Seattle
• ASN: 396190
• Country: United States (Washington)
• CIDR Block: 108.62.56.0/21
• RIR: ARIN
• Abuse Contact: abuse@us.leaseweb.com

---

THREAT ASSESSMENT

Risk Score: 50/100 (Moderate)

• Abuse Confidence: Not explicitly scored
• Blacklist Status: 0 blacklists
• Threat Indicators: None detected
• Campaign Correlation: No known campaigns
• Known Attacker: No
• Spam Source: No

The IP shows minimal threat activity but exists within a high-abuse density subnet. No active malicious services were observed on this address.

---

SUBNET CONTEXT (108.62.56.0/24)

• Abuse Density: 0.3828 (Elevated)
• Classification: Mixed
• Threat Siblings: 98 out of 256 addresses (38.3%)
• Active Siblings: 169
• Risk Distribution in Subnet: 4 high-risk, 93 medium-risk, 3 low-risk

The parent /24 subnet shows significant abuse presence, suggesting the IP may be part of a compromised hosting block or misconfigured infrastructure.

---

OBSERVATION HISTORY

Total Observations: 22

Recent Signals (2026-06-24):

• Subnet abuse density analysis: 0.3828 (mixed classification)
• Operator score: 0/100 (minimal)
• Geolocation signals: US (confidence 0.35)

Historical Records:

• Organization data consistently attributed to LeaseWeb USA, Inc. Seattle
• No ownership changes detected
• Threat persistence: Not persistently malicious

---

NETWORK BEHAVIOR

• Service Status: Firewalled / No services detected
• Open Ports: None
• DNS Records: No PTR hostnames, no hosted domains
• Email Auth: No SPF/DMARC records
• Tor Exit Node: No
• CDN/Cloud/Proxy: No indicators

---

CONTROL PLANE DATA

• BGP Prefix: 108.62.56.0/21
• Origin ASN: 396190
• Routing Stability: Not stable
• DNSBL Listings: 2 out of 8 total lists
• RPKI Status: Not validated
• Route Changes (30d): 0

---

RECOMMENDED ACTIONS

Immediate Mitigation:

```bash

# iptables

iptables -A INPUT -s 108.62.56.247 -j DROP

# nftables

nft add rule inet filter input ip saddr 108.62.56.247 drop

# nginx

deny 108.62.56.247;

# pfSense

108.62.56.247/32

# Cloudflare WAF

ip.src eq 108.62.56.247 → Block

# AWS WAF

Addresses: [108.62.56.247/32] → Block

```

Strategic Recommendations:

1. Block at perimeter firewall due to moderate risk score (50/100)

2. Monitor parent subnet 108.62.56.0/24 for additional malicious activity

3. Consider broader subnet blocking if business traffic from this range is not required

4. Review incoming traffic from 108.62.56.0/21 for correlation with known threats

---

ANALYST NOTES

This IP appears to be part of LeaseWeb's residential/hosting infrastructure. While no direct threat indicators were observed, the high abuse density of the parent subnet warrants defensive blocking. The lack of active services suggests this may be a parked or dormant IP, but its association with 38.3% malicious siblings in the /24 subnet makes it a defensive priority.

Confidence Level: Medium

Data Sources: IPDebrief intelligence platform

Last Updated: Current cycle

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.