108.62.59.155📋 Copy

## IP INTELLIGENCE BRIEFING: 108.62.59.155/32

Classification: MODERATE RISK

Date of Analysis: 2026-06-10

Reporting Analyst: IPDebrief Intelligence

---

EXECUTIVE SUMMARY

IP 108.62.59.155 is a LeaseWeb USA infrastructure endpoint registered to ASN 396190 in Seattle, WA. The IP demonstrates moderate risk characteristics with a risk score of 50/100. No active threat indicators detected; however, the /24 subnet exhibits elevated abuse density (0.793), indicating 203 threat siblings among 256 total addresses. The address shows no evidence of malicious activity in isolation but warrants monitoring due to neighborhood context.

---

OWNERSHIP & INFRASTRUCTURE

Network Classification: The IP is classified as infrastructure with no services detected. Port scans returned no open ports, and the service purpose is marked as "Firewalled / No Services." No certificate or TLS data available.

---

THREAT ASSESSMENT

Current Risk Profile:

• Risk Score: 50 (Moderate)
• Abuse Confidence: Not applicable (no active abuse indicators)
• Blacklist Status: Listed on 2 of 8 DNSBL lists
• Threat Indicators: None detected
• Known Campaigns: None correlated
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Historical Observations: 19 total observations recorded. No persistent malicious activity detected. Most recent observation (2026-06-10) showed minimal operator score (0.15) and DNSSEC validation active.

---

NEIGHBORHOOD ANALYSIS

The /24 subnet (108.62.59.0/24) demonstrates concerning neighborhood metrics:

Assessment: 203 threat siblings represent approximately 79% of active IPs in the neighborhood. This elevated density suggests the subnet may be compromised or misconfigured.

---

RELATIONSHIP GRAPH

Total relationships: 68

Primary relationship type: Same Network (108-62-56-0) appearing 68 times

---

RECOMMENDED ACTIONS

Defense-in-Depth Recommendations:

1. Network Filtering: Consider blocking or rate-limiting this IP at perimeter firewall if traffic is unexpected.

2. Monitoring Priority: Flag for enhanced monitoring due to high-abuse neighborhood context. Monitor for anomalous outbound connections or scanning activity.

3. DNSBL Verification: Investigate the 2 DNSBL listings to determine blacklist source and reason for listing.

4. Behavioral Analysis: Establish baseline traffic patterns; investigate any deviations from expected infrastructure behavior.

---

CONCLUSION

IP 108.62.59.155 presents moderate risk primarily due to neighborhood context rather than intrinsic malicious characteristics. The infrastructure endpoint itself shows no active threat indicators, but the surrounding subnet's high abuse density warrants continued surveillance. Recommended action is monitoring rather than immediate blocking, with escalation triggered by observed malicious behavior or increased DNSBL associations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.