108.62.58.60📋 Copy

# IP Intelligence Briefing: 108.62.58.60/32

Date: 2026-06-24

Classification: Moderate Risk

Risk Score: 50/100

---

## Executive Summary

IP 108.62.58.60 is associated with LeaseWeb USA, Inc. Seattle (ASN 396190) and presents moderate risk. The IP is firewalled with no active services, but resides within a subnet exhibiting high abuse density. The address has been listed on 2 of 8 known DNS blacklists.

---

## Ownership and Geolocation

• Organization: LeaseWeb USA, Inc. Seattle
• ASN: 396190
• Country: United States (WA)
• City: Seattle
• CIDR Block: 108.62.56.0/21

---

## Network Classification

• Status: Firewalled / No Services
• Open Ports: None detected
• DNS Resolution: No forward resolution
• PTR Hostnames: None
• ISP Type: Infrastructure provider (not residential/mobile)

---

## Threat Indicators

• Blacklist Count: 2/8 DNSBL listings
• Threat Feeds: No active threat indicators
• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No

Control Plane Assessment:

• Operator Score: 0.2174 (Minimal)
• Route Stability: Unstable
• RPKI State: Not validated
• DNSSEC: Valid

---

## Neighborhood Analysis

The /24 subnet (108.62.58.0/24) shows concerning abuse patterns:

• Abuse Density: 0.8398 (High)
• Total Siblings: 256
• Active Siblings: 132
• Threat Siblings: 215
• Inherited Risk: 33/100

Risk distribution across the subnet: 100 medium-risk neighbors, 0 high/low-risk.

---

## Historical Observation

21 signal observations recorded over the monitoring period. Key observations:

• 2026-06-04: Subnet abuse density classified as "high_abuse" with 215 threat siblings
• 2026-06-09: Control plane operator score 0.2174 (Minimal)
• 2026-06-24: Current assessment shows "Minimal" operator score

The IP demonstrates persistent presence within a high-abuse neighborhood without escalating to known malicious activity.

---

## Recommended Actions

Block this IP address at the network perimeter:

```bash

# iptables

iptables -A INPUT -s 108.62.58.60 -j DROP

# nftables

nft add rule inet filter input ip saddr 108.62.58.60 drop

# nginx

deny 108.62.58.60;

```

Cloud WAF Rules:

• Cloudflare: Block IP — IPDebrief risk score 50
• AWS WAF: Add 108.62.58.60/32 to blocked addresses

---

## Intelligence Assessment

The IP address is not actively malicious but resides within a compromised subnet with significant abuse activity (84% abuse density). The moderate risk score (50) combined with DNSBL listings and high neighborhood abuse density warrants defensive blocking. The infrastructure appears to be part of a broader hosting environment with multiple IPs showing elevated risk profiles.

Recommendation: Implement blocking rules and monitor for related IPs within the 108.62.56.0/21 range that may require additional scrutiny.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.