108.62.63.9📋 Copy

# IP INTELLIGENCE BRIEFING: 108.62.63.9/32

Date: 2026-06-24

Classification: MODERATE RISK (Score: 50)

Analysis Type: Network Threat Intelligence

---

## EXECUTIVE SUMMARY

IP address 108.62.63.9 is registered to LeaseWeb USA, Inc. Seattle (ASN 396190) and presents moderate risk with multiple indicators of compromise. The IP is hosted on infrastructure that shows route instability and is listed on 2 of 8 DNSBLs. The /24 subnet exhibits elevated abuse density (0.6562) with 168 threat siblings out of 256 total addresses, indicating potential malicious activity within the network block.

---

## OWNERSHIP & GEOLOCATION

• Organization: LeaseWeb USA, Inc. Seattle
• ASN: 396190
• Location: Seattle, WA, US
• Registration: ARIN (contact available via RDAP)
• IP Classification: Provider infrastructure

---

## THREAT INDICATORS

Control Plane Analysis:

• Route Stability: UNSTABLE (isRouteStable: false)
• Operator Score: 0.1304 (Minimal)
• DNSSEC Valid: Yes

---

## NETWORK BEHAVIOR

• Services: No open ports detected (Firewalled / No Services)
• DNS: No PTR records, forward resolution failed
• Email: No SPF/DMARC records configured
• HTTP: No TLS certificates, no active web services
• Historical Observations: 24 signals observed; risk profile consistent over time with minimal changes

---

## NEIGHBORHOOD ANALYSIS

Subnet: 108.62.63.0/24

Abuse Density: 0.6562 (High Abuse Classification)

Threat Siblings: 168 out of 256 total IPs

Risk Distribution: 100 medium-risk IPs, 0 high-risk IPs

The elevated abuse density suggests this subnet may be part of a larger infrastructure with significant malicious activity. Correlate with other IPs in the 108.62.x.x block for comprehensive threat assessment.

---

## RELATIONSHIP MAPPING

Total Relationships: 105

Primary Association: Same Network (108.62.56.0/21)

The IP shares network relationships with multiple addresses in the 108.62.56.0/21 block. This indicates infrastructure co-location or organizational association.

---

## RECOMMENDED ACTIONS

Immediate Mitigation:

```bash

# iptables

iptables -A INPUT -s 108.62.63.9 -j DROP

# nftables

nft add rule inet filter input ip saddr 108.62.63.9 drop

# Cloudflare WAF

ip.src eq 108.62.63.9 —> BLOCK

```

Extended Block List:

• Consider blocking the broader /24 subnet (108.62.63.0/24) given high abuse density
• Monitor ASN 396190 for additional suspicious activity
• Implement rate limiting for traffic from this block

Monitoring Priorities:

• Watch for route stabilization changes
• Track DNSBL additions
• Monitor for service emergence on previously firewalled infrastructure

---

Disclaimer: Recommendations are probabilistic and should be combined with local telemetry, threat intelligence feeds, and business context before implementing blocking actions.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.