108.62.58.210📋 Copy

# IP Intelligence Briefing: 108.62.58.210/32

Classification: Moderate Risk | Status: Active | Analysis Date: June 2026

## Executive Summary

IP address 108.62.58.210 is a US-based infrastructure endpoint associated with LeaseWeb USA, Inc. (Seattle, WA) operating under AS396190. The IP presents moderate risk (score: 50) with no active threat indicators but is located within a high-abuse density subnet (108.62.58.0/24: 0.8633 abuse rate). The endpoint shows historical proxy/compromised server classification.

## Ownership and Geolocation

• Organization: LeaseWeb USA, Inc. Seattle
• ASN: 396190
• Country/Region: United States, Washington
• City: Tukwila
• Geolocation Confidence: Plausible (consensus: true)

## Risk Assessment

• Overall Risk Score: 50/100 (Moderate Risk)
• Blacklist Status: Listed on 2 of 8 DNSBL feeds
• Threat Indicators: None detected
• Campaign Association: None identified
• Persistence: Not classified as persistently malicious

## Network Context

• Subnet: 108.62.58.0/24
• Neighborhood Abuse Density: High (0.8633)
• Threat Siblings: 221 out of 256 IPs flagged as threats
• Current Risk Distribution: 100 medium-risk IPs in subnet
• BGP Prefix: 108.62.56.0/21

## Technical Profile

• Service Status: Firewalled / No services detected
• Open Ports: None
• DNS Resolution: Failed forward resolution
• PTR Records: None
• TLS/Certificates: None detected

## Historical Observations

Analysis of 24 signal observations reveals:

• Recent Activity (2026-06-24): Minimal signals detected
• Earlier Observation (2026-06-04): Classified as "proxy/compromised server" with risk score 66
• Geolocation Variance: Multiple location sources reporting US origin

## Recommended Actions

Based on risk profile and neighborhood context, the following blocking rules are recommended:

Firewall Rules:

```

iptables -A INPUT -s 108.62.58.210 -j DROP

nft add rule inet filter input ip saddr 108.62.58.210 drop

```

Application-Level Blocking:

```nginx

deny 108.62.58.210;

```

Cloud/WAF Rules:

• Cloudflare WAF: Block IP 108.62.58.210 with expression `ip.src eq 108.62.58.210`
• AWS WAF: Add 108.62.58.210/32 to blocked addresses list
• pfSense: Configure block rule for 108.62.58.210/32

## Intelligence Notes

• The IP resides within a high-abuse subnet; consider implementing subnet-level filtering (108.62.58.0/24) for enhanced protection
• Historical proxy classification warrants continued monitoring despite current low signal activity
• No active threat indicators detected, but neighborhood context suggests elevated risk profile

---

*Intel generated from IPDebrief platform. Verify with additional threat intelligence sources before implementing blocking rules.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.