108.62.62.23📋 Copy

# IP Intelligence Briefing: 108.62.62.23/32

## Executive Summary

IP 108.62.62.23 presents a MODERATE RISK profile with a risk score of 50. The address is associated with LeaseWeb USA, Inc. Seattle (ASN: 396190) and is geolocated to Seattle, WA. While no direct threat indicators were identified, the IP resides in a high-abuse-density subnet (108.62.62.0/24) with 145 threat siblings detected, warranting defensive consideration.

## Risk Profile

## Technical Details

• Organization: LeaseWeb USA, Inc. Seattle
• ASN: 396190
• Geolocation: United States, Washington, Seattle
• DNS: 108.62.62.23.rdns.1ue.com
• Network Role: Firewalled / No Services (no open ports detected)
• Control Plane: Route stable (0 changes in 30 days), RPKI valid, DNSSEC valid
• ISP Class: Basic (Operator Score: 0.3913)

## Neighborhood Analysis

The IP is part of subnet 108.62.62.0/24 with concerning characteristics:

• Abuse Density: 0.5664 (high_abuse classification)
• Total Siblings: 256
• Active Siblings: 143
• Threat Siblings: 145
• Inherited Risk: 22

Neighboring IPs show mixed risk distribution (8 high, 91 medium, 1 low), indicating the subnet warrants monitoring rather than blanket blocking.

## Threat Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaigns: None detected
• Scans/Probes: No recent activity observed

## Historical Observations

Analysis of 28 observations reveals consistent behavior over time:

• Recent operator scores: 0.3913 (Basic) and 0.2174 (Minimal)
• No significant risk escalation detected
• Ownership and threat persistence stable (0 changes)
• Threat observation count: 1

## Recommended Actions

Given the moderate risk score and high-abuse subnet context:

1. Firewall Rules (recommended):

- `iptables`: `iptables -A INPUT -s 108.62.62.23 -j DROP`

- `nftables`: `nft add rule inet filter input ip saddr 108.62.62.23 drop`

- `nginx`: `deny 108.62.62.23;`

- `Cloudflare WAF`: Block IP with expression `ip.src eq 108.62.62.23`

- `AWS WAF`: Add `108.62.62.23/32` to block list

2. Subnet-level Monitoring: Consider monitoring the 108.62.62.0/24 subnet due to high abuse density (0.5664) and 145 threat siblings.

3. Investigation Priority: MEDIUM - Monitor for traffic patterns rather than immediate blocking unless additional context is provided.

## SOC Analyst Notes

This IP presents a moderate threat profile with no direct malicious indicators. The primary concern is the high-abuse-density subnet context. Recommend implementing the provided firewall rules while correlating with internal threat data. The IP shows stable routing and no recent behavioral changes, suggesting established rather than ephemeral malicious activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.