173.234.225.138📋 Copy

# IP Intelligence Briefing: 173.234.225.138/32

## Executive Summary

IP 173.234.225.138 operates as a moderate-risk address (risk score 50) within the 173.234.225.0/24 subnet under Leaseweb USA, Inc. (ASN 394380). The IP is classified as colocation hosting infrastructure with no active services. Despite showing no direct threat indicators, the subnet exhibits high abuse density (0.8789), and the IP is recommended for blocking due to its association with a high-abuse neighborhood.

## Infrastructure Profile

• ASN: 394380 (Leaseweb USA, Inc.)
• Organization: Choopa/GameServers
• Location: Dallas, TX, US
• Infrastructure Type: Colocation Hosting
• Network Role: Firewalled/No Services
• BGP Prefix: 173.234.225.0/24
• Route Stability: Stable (delegation age: 3,947 days)

## Threat Assessment

• Risk Score: 50 (Moderate Risk)
• Abuse Confidence: Not elevated
• Known Threats: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Status: Listed on 2 of 8 total lists
• Campaign Association: None

## Network Neighborhood Analysis

The 173.234.225.0/24 subnet demonstrates elevated abuse characteristics:

• Abuse Density: 0.8789 (high)
• Classification: high_abuse
• Total Subnet Siblings: 256
• Active Siblings: 184
• Threat Siblings: 225
• Neighbor Risk Distribution: 100 medium-risk (score 50), 0 high-risk, 0 low-risk

This subnet-wide context indicates the IP operates within a hosting environment with significant abuse activity, warranting defensive consideration despite the individual IP's lack of direct threat signals.

## Service & DNS Observations

• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: None
• DNS PTR Records: None
• Forward Resolution: Not confirmed
• Hosted Domains: 0

## Temporal Analysis

Forty-six signal observations tracked over the observation period. Recent signals (June 23-24, 2026) show minimal threat levels with operator scores ranging 0.2174-0.25. No significant threat escalation detected in the historical record.

## Recommended Security Actions

Based on risk profile, the following blocking measures are recommended:

## Intelligence Notes

• The IP's high neighborhood abuse density (0.8789) and classification as "high_abuse" suggest elevated risk from lateral threat activity within the /24 subnet.
• While the IP itself shows no direct threat indicators, the subnet's abuse characteristics warrant continued monitoring.
• Relationship graph indicates 134 connections, primarily to same-network entities (LU-79), consistent with colocation hosting infrastructure.
• No evidence of persistent malicious activity or campaign correlation.

---

*Report generated: 2026-06-24*

*Data source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.