108.62.59.191📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 108.62.59.191/32

Classification: Moderate Risk / High Abuse Environment

Date of Analysis: 2026-06-24

---

## EXECUTIVE SUMMARY

IP 108.62.59.191 is a LeaseWeb USA, Inc. Seattle infrastructure address classified as moderate risk (score: 50). The IP resides within a high-abuse-density subnet (108.62.59.0/24) where 79% of sibling addresses are flagged for abuse. Current service scanning indicates the IP is firewalled with no open ports detected.

---

## OWNERSHIP & GEOLOCATION

• ASN: 396190 (LeaseWeb USA, Inc. Seattle)
• Organization: LeaseWeb USA, Inc. Seattle
• RIR: ARIN
• Geolocation: United States, Washington, Seattle (2,500 km accuracy radius)
• BGP Prefix: 108.62.56.0/21
• Route Stability: Stable (no route changes in 30 days)
• RPKI State: Not validated

---

## THREAT ASSESSMENT

Historical Trend: 25 observations recorded between 2026-06-10 and 2026-06-24. Persistent threat pattern observed with 1 threat observation event.

---

## NETWORK CONTEXT

Subnet Analysis (108.62.59.0/24):

• Total Siblings: 256
• Active Siblings: 94
• Threat Siblings: 203
• Abuse Density: 0.793 (High)
• Inherited Risk Score: 31

The subnet demonstrates elevated abuse activity with 79% of IP addresses flagged. This contextual risk factor significantly elevates the threat posture of the target IP beyond its standalone risk score.

---

## NETWORK SERVICES

• Open Ports: None detected
• Service Purpose: Firewalled / No Services
• TLS Certificate: Not present
• Hosted Domains: 0
• DNS PTR Records: None
• Forward Resolution: Not confirmed

---

## RELATIONSHIP GRAPH

114 relationships identified, primarily consisting of same-network associations (108-62-56-0 prefix). No certificate, hostname, or organization-level relationships detected.

---

## RECOMMENDED ACTIONS

Based on the risk profile and neighborhood context, the following mitigation rules are recommended:

Firewall Blocking:

```

iptables -A INPUT -s 108.62.59.191 -j DROP

nft add rule inet filter input ip saddr 108.62.59.191 drop

```

Web Application Firewall:

```

nginx: deny 108.62.59.191;

Cloudflare WAF: Block (risk score 50)

AWS WAF: Add 108.62.59.191/32 to blocklist

```

Priority: Medium to High (due to subnet abuse density)

Rationale: While the IP shows no active threat indicators, the high-abuse subnet context and DNSBL listings warrant defensive blocking.

---

Intelligence Confidence: High (based on neighborhood density and DNSBL data)

Action Required: Block at perimeter firewall level; monitor for traffic patterns

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.