108.62.59.231📋 Copy

# IP Intelligence Briefing: 108.62.59.231

## Executive Summary

IP address 108.62.59.231 is a LeaseWeb USA infrastructure endpoint located in Seattle, WA operating under moderate risk classification. The IP exhibits a risk score of 50, with no active open services detected. Historical data indicates dynamic risk profile fluctuations, with recent blacklist listings emerging alongside earlier minimal-risk observations.

## Ownership & Geolocation

• Organization: LeaseWeb USA, Inc. Seattle (ASN 396190)
• Location: Seattle, Washington, United States
• Network Block: 108.62.56.0/21 (BGP prefix)
• Registration: ARIN (RIR)

## Threat Profile

• Risk Score: 50 (Moderate Risk)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Presence: Listed on 2 of 8 threat feeds
• Operator Classification: Minimal
• DNSBL Listed: 2 total lists

## Network Services & Fingerprinting

• Open Ports: None detected (firewalled)
• DNS Resolution: No PTR records, no forward resolution
• TLS/SSL: No certificates detected
• HTTP Services: No web presence detected
• Service Purpose: Firewalled / No Services

## Neighborhood Analysis

The /24 subnet (108.62.59.0/24) demonstrates concerning abuse characteristics:

• Abuse Density: 0.8125 (high)
• Subnet Classification: High Abuse
• Total Siblings: 256
• Active Siblings: 103
• Threat Siblings: 208

All sampled neighbor IPs (108.62.59.0 through 108.62.59.4) maintain risk score 50 with authority score 50, indicating consistent threat posture across the subnet.

## Historical Trend Analysis

Observation history reveals 19 data points with notable temporal variations:

• 2026-06-24: Recent observations show high-severity blacklist listings across 8 lists
• 2026-06-10: Earlier observations indicated minimal risk with operator score 0.1304
• Risk Persistence: 0 threat observation days
• Ownership Stability: No ownership changes recorded

## Relationship Intelligence

The IP maintains 79 relationships, predominantly "Same Network" connections to network 108-62-56-0. This indicates infrastructure integration within the broader LeaseWeb network infrastructure.

## Recommended Security Actions

Based on risk profile, the following actions are recommended:

1. Monitor: Continue observing blacklist status changes

2. Block: Consider blocking if connected to malicious activity

3. Investigate: Review network traffic patterns for lateral movement

4. Blocklist: Add to allowlist exceptions if legitimate traffic is observed

## Intelligence Narrative

IP 108.62.59.231 represents a LeaseWeb infrastructure endpoint with moderate risk characteristics. The subnet demonstrates elevated abuse density, suggesting potential infrastructure sharing or coordinated network operations. Recent blacklist activity indicates emerging threat indicators. No active services or open ports detected, which may indicate firewall protection or dormant infrastructure. The consistent 50-point risk score across neighborhood IPs suggests systemic rather than isolated threat behavior. SOC teams should monitor for activity correlation with other subnet addresses and evaluate traffic patterns for legitimate business use cases versus potential abuse vectors.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.