108.62.62.185📋 Copy

# IP Intelligence Briefing: 108.62.62.185/32

## Executive Summary

IP address 108.62.62.185 is classified as Moderate Risk with a risk score of 50. The address is owned by LeaseWeb USA, Inc. Seattle (ASN 396190) and is geolocated to Seattle, WA. The IP is currently in a firewalled state with no active services, but the associated /24 subnet shows elevated abuse density.

## Ownership and Infrastructure

## Threat Indicators

• Risk Score: 50 (Moderate)
• DNSBL Listed: 2 of 8 total lists
• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Feeds: None populated

## Network Services Assessment

• Open Ports: None detected
• HTTP/HTTPS: No services listening
• TLS Certificates: None
• DNS Records: No PTR or forward resolution
• Service Purpose: Firewalled / No Services

## Subnet Neighborhood Analysis (108.62.62.0/24)

• Total Siblings: 256 IPs
• Active Siblings: 141
• Threat Siblings: 143
• Abuse Density: 0.5586 (High Abuse Classification)
• Risk Distribution: 9 High, 91 Medium, 0 Low

The IP operates within a subnet showing significant abuse activity. Of 100 sampled neighbors, 9 were classified as high-risk. The subnet's overall abuse density suggests concentrated malicious activity from adjacent addresses.

## Historical Observation Trend

Analysis of 17 observations spanning June 17–19, 2026 indicates stable threat posture with no escalation:

• Consistent Risk Level: All observations returned "Minimal" risk designation (0.15 raw score)
• Operator Score: 0.1304 across all observations
• Threat Persistence: Zero persistence days
• Ownership Changes: None recorded

## Recommended Security Actions

Based on the IP's risk profile and neighborhood context, the following blocking rules are recommended:

Firewall Rules:

• `iptables -A INPUT -s 108.62.62.185 -j DROP`
• `nft add rule inet filter input ip saddr 108.62.62.185 drop`
• `nginx: deny 108.62.62.185;`
• `pfSense: 108.62.62.185/32`
• Cloudflare WAF: Block IP 108.62.62.185 — IPDebrief risk score 50
• AWS WAF: Add 108.62.62.185/32 to blocked addresses

## Intelligence Assessment

The IP 108.62.62.185 presents moderate risk primarily due to its neighborhood context rather than individual threat indicators. The absence of open services and clean DNS footprint suggest this is an infrastructure address within a high-abuse subnet. The consistent "Minimal" risk signals over multiple observations indicate this IP has not been actively exploited as a compromised host.

SOC Action Priority: Monitor — Block at perimeter firewall level if traffic is observed. The subnet's high abuse density warrants consideration of blocking the entire /24 range if operational impact permits.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.