108.62.61.244📋 Copy

THREAT INTELLIGENCE BRIEFING: 108.62.61.244/32

Executive Summary

IP address 108.62.61.244 is a LeaseWeb USA infrastructure endpoint assigned to ASN 396190. The IP demonstrates moderate risk (score 50) with firewalled/no-services status. The IP operates within a high-abuse density subnet (108.62.61.0/24) where 56.6% of 256 sibling IPs exhibit threat activity.

Ownership & Infrastructure

• Organization: LeaseWeb USA, Inc. Seattle
• ASN: 396190
• Geolocation: Seattle, WA, United States
• Network Classification: Provider infrastructure with firewalled/no-services state
• DNS Resolution: No forward-resolved hostnames; forward confirmation disabled

Threat Posture

• Overall Risk Score: 50 (Moderate)
• Blacklist Status: Listed on 2 of 8 DNSBL feeds (dnsblListedCount: 2)
• Operator Score: 0.2609 (Basic classification)
• Tor/Proxy Status: Not a Tor exit, proxy, or VPN endpoint
• Active Threat Indicators: No known attacker flags; no spam source classification

Behavioral Analysis

• Service Exposure: No open ports detected; TLS certificates not present
• Control Plane: RPKI validation status unavailable; IRR consistency not verified
• Route Stability: Network exhibits route instability (isRouteStable: false)
• Observation History: 25 signal observations recorded over the assessment period. Historical data indicates blacklist activity on 2026-06-17 with high-severity categorization.

Network Context

• Subnet Abuse Density: High-abuse classification for 108.62.61.0/24
• Sibling Analysis: 146 of 256 total siblings flagged as threats; 143 active siblings
• Risk Distribution: 100 sibling IPs classified as medium risk; none classified as high risk
• Related Networks: 126 relationship entries identified, primarily same-network associations (108-62-56-0 ranges)

SOC Actions & Recommendations

1. Monitoring: Apply medium-priority monitoring for this IP given its subnet's elevated abuse density

2. Threat Hunting: Correlate with other LeaseWeb USA infrastructure endpoints showing similar patterns

3. DNSBL Review: Investigate the 2 DNSBL listings to determine if this affects legitimate traffic

4. Block Consideration: Given the high-abuse subnet classification and historical blacklist activity, consider blocking or rate-limiting if not already implemented

Risk Assessment

The IP presents moderate risk but operates within a higher-risk subnet environment. While the endpoint itself shows no active threat indicators, the neighborhood context suggests this infrastructure may support compromised hosts. Monitor for emerging threat signals and maintain correlation with related LeaseWeb assets.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.