173.234.225.112📋 Copy

# IP INTELLIGENCE BRIEFING: 173.234.225.112/32

## Executive Summary

IP address 173.234.225.112 is a moderate-risk (risk score: 50) infrastructure address hosted by Choopa/GameServers within the Leaseweb USA, Inc. colocation network (ASN: 394380). The IP is geolocated to Dallas, TX and operates with no open services detected, though the subnet exhibits high abuse density. Recommended action: Block at perimeter firewall.

---

## Host Profile & Classification

Ownership & Registration:

• Organization: Leaseweb USA, Inc.
• ASN: 394380
• Location: Dallas, TX, United States
• RIR: ARIN
• BGP Prefix: 173.234.224.0/22

Network Classification:

• Role: Colocation Hosting / Game Server Provider
• Infrastructure: Firewalled / No Services
• Service Purpose: Hosting infrastructure
• DNS Status: No PTR records; no forward resolution confirmed
• Open Ports: None detected

---

## Risk Assessment

Current Risk Score: 50 (Moderate Risk)

Risk Components:

• Provider Score: 0
• Authority Score: 0
• Stability Score: 0
• Operator Score: 0.1304 (Minimal)

Threat Indicators:

• Blacklist Count: 0
• DNSBL Listings: 2 of 8 total lists
• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No

---

## Neighborhood Analysis

Subnet: 173.234.225.112/24

• Classification: High Abuse
• Abuse Density: 0.8359
• Total Siblings: 256
• Active Siblings: 179
• Threat Siblings: 214

Risk Distribution: 100% medium-risk neighbors, 0% high/low risk

Implication: This /24 subnet demonstrates consistent medium-risk activity across all monitored addresses, suggesting systemic abuse patterns rather than isolated incidents.

---

## Relationship Graph

Total Relationships: 111

• Primary Association: Network LU-79 (multiple same-network relationships)
• Network Affiliation: Choopa/GameServers infrastructure

The IP maintains numerous relationships with network LU-79, indicating it is part of a larger hosting infrastructure cluster.

---

## Observation History

Total Observations: 38

Recent temporal data (June 2026) shows:

• Multiple operator score assessments rated "Minimal"
• Geographic validation challenges due to ICMP blocking
• No persistent malicious indicators detected

Threat Persistence: 0 days; Not classified as persistently malicious.

---

## Recommended Actions

Immediate Mitigation:

Block traffic from this IP at all perimeter security devices.

Firewall Rule Examples:

```bash

# iptables

iptables -A INPUT -s 173.234.225.112 -j DROP

# nftables

nft add rule inet filter input ip saddr 173.234.225.112 drop

# nginx

deny 173.234.225.112;

# pfSense

173.234.225.112/32

# Cloudflare WAF

Expression: ip.src eq 173.234.225.112

Action: Block

# AWS WAF

Addresses: 173.234.225.112/32

```

---

## Intelligence Assessment

This IP address represents moderate-risk hosting infrastructure within a high-abuse-density subnet. While no active threat indicators are currently associated with this specific address, the neighborhood context (214 threat siblings in /24) warrants defensive blocking. The IP's classification as "firewalled / no services" suggests it may be part of broader hosting infrastructure rather than an active attacker endpoint.

Priority: Medium

Action Required: Block at perimeter

Monitoring: Continue neighborhood-level surveillance for subnet 173.234.225.0/24

---

*Report generated: 2026-06-19*

*Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.