108.62.60.93📋 Copy

# IP Intelligence Briefing: 108.62.60.93/32

Classification: Moderate Risk | Status: Active Monitoring Required | Date: 2026-06-24

---

## Executive Summary

IP address 108.62.60.93 is assigned to LeaseWeb USA, Inc. Seattle (ASN: 396190) and presents a moderate risk profile with a risk score of 50. While the IP itself shows no active threat indicators, the parent subnet (108.62.60.0/24) demonstrates high abuse density (0.6797) with 174 threat-sibling IPs out of 256 total addresses. The IP is currently firewalled with no open services.

---

## Network Ownership & Geolocation

---

## Threat Profile

Current Risk Indicators:

• Risk Score: 50 (Moderate)
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Threat Indicators: None detected
• Campaign Association: None
• Tor/Proxy: Not a Tor exit node, proxy, or VPN

Network Role:

• Services: Firewalled / No Services
• Open Ports: None
• DNS Resolution: Forward resolution not confirmed
• Hosted Domains: 0

---

## Temporal Analysis

Observation History (23 total signals):

• Recent activity confirms US geolocation (confidence: 0.35-0.60)
• Operator score maintained at 0.2174 (Minimal)
• Subnet abuse classification: high_abuse
• Ownership stability: No changes recorded
• Threat persistence: 0 days (not persistently malicious)

Route Stability:

• Route changes detected in last 30 days
• RPKI state: Unknown
• DNSSEC: Valid

---

## Neighborhood Assessment

Subnet: 108.62.60.0/24

• Abuse Density: 0.6797 (High)
• Active Siblings: 165 of 256 addresses
• Threat Siblings: 174
• Inherited Risk Score: 27

Risk Distribution in Subnet:

• High Risk: 0
• Medium Risk: 99
• Low Risk: 1

---

## Recommended Actions

For SOC Teams:

1. Monitor inbound traffic from 108.62.60.0/24 subnet due to high abuse density

2. Implement rate limiting for connections from this subnet

3. Monitor for scanning activity - subnet contains 174 threat-sibling IPs

4. Review firewall rules - IP is currently firewalled but may receive spoofed traffic

Firewall Recommendations:

• Consider blocking or rate-limiting traffic from 108.62.56.0/21 range
• Apply geo-based filtering if traffic patterns warrant
• Monitor DNS queries for spoofed hostnames from this subnet

---

## Key Intelligence Indicators

• DNSBL Listing: 2 of 8 lists (requires review)
• Subnet Context: High-abuse classification with 68% abuse density
• Provider Risk: LeaseWeb infrastructure with Seattle operations
• No Direct Threats: IP itself clean, but neighborhood context elevated

---

Confidence Level: Medium | Data Sources: 23 historical signals | Last Updated: 2026-06-24

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.