108.62.56.96📋 Copy

# Intelligence Briefing: 108.62.56.96/32

## Executive Summary

IP address 108.62.56.96 is assigned to LeaseWeb USA, Inc. Seattle (ASN 396190). The IP demonstrates moderate risk characteristics with a risk score of 50 and no active threat indicators. The subnet environment shows elevated abuse activity, warranting monitoring.

## Ownership and Infrastructure

• Organization: LeaseWeb USA, Inc. Seattle
• ASN: 396190
• Location: United States, Washington, Seattle
• CIDR Block: 108.62.56.0/24
• Network Classification: Firewalled / No Services detected

## Threat Assessment

• Risk Score: 50 (Moderate Risk)
• Blacklist Status: Not listed on major threat feeds (0 blacklists)
• Known Threat Indicators: None detected
• Is Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Association: No known campaign matches

## Network Behavior and Services

• Open Ports: None observed
• DNS Resolution: No PTR hostnames, forward resolution unconfirmed
• SSL/TLS Certificates: No certificates detected
• Email Authentication: SPF/DMARC not configured

## Neighborhood Analysis

The IP resides in subnet 108.62.56.0/24, classified as high abuse:

• Abuse Density: 74.61%
• Total Siblings: 256
• Threat Siblings: 191
• Active Siblings: 119
• Risk Distribution in Subnet: 4 high-risk, 93 medium-risk, 3 low-risk neighbors
• Inherited Risk Score: 29

## Control Plane Data

• BGP Prefix: 108.62.56.0/21
• Route Stability: Unstable (isRouteStable: false)
• DNSBL Listings: 2 out of 8 total lists
• RPKI State: Not validated
• Route Changes (30 days): 0

## Observation History

Analysis of 23 historical observations indicates:

• Observation Period: June 2024–June 2026
• Threat Persistence: 0 days
• Ownership Changes: 0
• Signal Types: Geolocation, operator, threat, network classification
• Confidence Levels: Variable (0.24–0.60)
• Status: Not persistently malicious

## Recommended Actions

1. Monitor: Add to watchlist due to elevated neighborhood abuse density

2. Block (Optional): Consider blocking at perimeter if internal policy requires action against moderate-risk provider IPs

3. Investigate: Monitor for any service openings or reputation changes

4. Allow (Default): No immediate block required; IP does not show active malicious behavior

## Conclusion

IP 108.62.56.96 is a legitimate provider IP from LeaseWeb with no current threat indicators. The moderate risk rating is primarily driven by the high-abuse-density neighborhood rather than direct malicious activity. Recommend monitoring for service activity changes and continued observation of subnet-level threat patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.