108.62.60.129📋 Copy

# IP Intelligence Briefing: 108.62.60.129/32

## Executive Summary

The target IP 108.62.60.129 is classified as a Moderate Risk endpoint (risk score: 50) hosted by LeaseWeb USA, Inc. Seattle (ASN 396190). The IP resides within a high-abuse subnet (108.62.60.0/24) with 73.83% abuse density and 189 of 256 sibling IPs flagged as threats. Current network classification shows the endpoint is firewalled with no active services.

## Risk Profile

## Ownership & Geolocation

• Organization: LeaseWeb USA, Inc. Seattle
• ASN: 396190
• CIDR Block: 108.62.56.0/21 (BGP prefix)
• Location: United States, Washington (Seattle)
• Geolocation Accuracy: Radius 2,500km, consensus validated across multiple sources
• Registration: ARIN RIR

## Network Services & DNS

• Open Ports: None detected
• DNS Records: No PTR records, no forward resolution
• Email Authentication: No SPF/DMARC records detected
• HTTP Services: No active web services
• TLS Certificates: None observed

## Threat Intelligence

• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False
• Campaign Correlation: No matching campaigns detected
• Threat Feeds: Multiple pulse indicators from AlienVault OTX (50+ pulses)
• Recent Activity: 23 signal observations recorded, with threat indicators observed as recently as June 2026
• Route Stability: Unstable routing (isRouteStable: false), though no route changes in last 30 days

## Neighborhood Analysis

The /24 subnet (108.62.60.0/24) shows concentrated abuse activity:

• Abuse Density: 73.83%
• Active Siblings: 172 of 256 IPs
• Threat Siblings: 189 IPs flagged
• Neighbor Risk Distribution: 99 medium-risk, 1 low-risk, 0 high-risk neighbors
• Risk Correlation: 100 neighboring IPs analyzed, most with risk score 50

## Relationship Graph

• Total Relationships: 116
• Primary Connections: Same network blocks (108.62.56.0/21)
• Entity Types: Network associations dominate relationship graph

## Historical Trends

23 observations tracked with consistent threat indicators:

• June 2026: Multiple threat pulses from AlienVault OTX
• June 2026: Operator score 0.2174 (minimal)
• June 2026: Subnet abuse density confirmed at 73.83%
• June 2026: Geographic validation challenges (ICMP blocked)
• No persistent malicious behavior flagged despite subnet-level abuse

## Recommended Actions

1. Monitor Traffic: Implement traffic analysis for this subnet (108.62.60.0/24) given high abuse density

2. DNSBL Verification: Confirm listing status across remaining 6 DNSBL sources

3. Service Monitoring: Continue passive monitoring for service emergence (currently firewalled)

4. Reputation Assessment: Evaluate if IP-specific reputation warrants additional blocking measures

5. Geolocation Validation: Consider additional probes to validate Seattle location claim

## Intelligence Notes

This IP represents a low-to-moderate risk endpoint within a heavily abused hosting network. The moderate risk score (50) combined with the high-abuse subnet context warrants defensive monitoring but does not indicate immediate threat. The lack of open services suggests this may be a residential or enterprise endpoint rather than a hosting infrastructure asset. Threat persistence is not flagged, indicating transient rather than persistent malicious activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.