108.62.58.137📋 Copy

# IP Intelligence Briefing: 108.62.58.137/32

## Executive Summary

IP 108.62.58.137 is a residential or infrastructure address under LeaseWeb USA, Inc. Seattle (ASN 396190) with a moderate risk score of 50. The IP shows no active services, no open ports, and no direct threat indicators. However, it resides in a high-abuse density subnet (108.62.58.0/24) with an abuse density of 0.8555 and 219 threat-sibling IPs out of 256 total addresses. Route instability is observed, and 2 DNSBL listings were identified across 8 total lists.

## Infrastructure Profile

## Threat Assessment

No direct threat indicators were observed. The IP is not classified as a Tor exit node, known attacker, spam source, or proxy. No honeypot hits, enumeration strikes, or WAF violations were recorded. Threat persistence is not flagged as malicious.

However, the surrounding network environment presents elevated risk:

• Subnet Abuse Density: 0.8555 (High Abuse Classification)
• Inherited Risk Score: 34
• Threat Siblings: 219 out of 256 addresses in the /24
• Route Stability: Unstable (isRouteStable: false)

## Historical Analysis

Eighteen observations were recorded. Recent signals (June 2026) show minimal operator activity with zero computed threat signals. No persistent malicious behavior was observed across the observation period. Ownership changes and threat persistence metrics indicate transient rather than established malicious activity.

## Network Relationships

The IP has 75 documented relationships, primarily with the 108-62-56-0 network block. No external organizations, hostnames, or certificates were linked in the relationship graph.

## Recommended Actions

Based on the risk profile and neighborhood context, the following firewall rules are recommended:

```

iptables: iptables -A INPUT -s 108.62.58.137 -j DROP

nftables: nft add rule inet filter input ip saddr 108.62.58.137 drop

Cloudflare WAF: Block IP 108.62.58.137 (Risk Score 50)

AWS WAF: Add 108.62.58.137/32 to block list

```

## SOC Analyst Considerations

1. Contextual Risk: While the individual IP shows no active threat indicators, the high-abuse subnet environment suggests potential for opportunistic abuse.

2. Block Recommendation: Consider blocking at the network perimeter given the 85.55% abuse density in the /24 subnet.

3. Monitoring: The unstable BGP routing and DNSBL listings warrant continued observation.

4. False Positive Potential: The IP shows no open services or active threat signatures; evaluate against actual incident indicators before implementing blocking rules.

---

*Report generated from IPDebrief intelligence platform. All data sourced from authorized defensive security analysis.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.