173.234.225.181📋 Copy

# IP Intelligence Briefing: 173.234.225.181/32

## Executive Summary

IP address 173.234.225.181 is a moderate-risk (50/100) hosting infrastructure endpoint located in Dallas, TX under Leaseweb USA, Inc. (ASN: 394380). The IP shows no active services but is hosted in a subnet with high abuse density (0.8789), containing 225 threat siblings. Recommended action: Monitor or block based on contextual risk.

## Infrastructure Profile

• Organization: Leaseweb USA, Inc. (ASN 394380)
• Classification: Colocation Hosting / Choopa/GameServers
• Geolocation: Dallas, TX, US (confidence radius: 2,500km)
• BGP Prefix: 173.234.224.0/22
• Service Status: Firewalled / No Services detected
• DNSBL Status: Listed on 2 of 8 checked threat feeds

## Neighborhood Analysis

The /24 subnet (173.234.225.0/24) exhibits elevated risk characteristics:

• Abuse Density: 0.8789 (high_abuse classification)
• Total Siblings: 256 IP addresses
• Active Siblings: 184
• Threat Siblings: 225
• Inherited Risk Score: 35

All neighboring IPs in the neighborhood show risk scores of 50, indicating systemic risk within the subnet infrastructure.

## Historical Observation

43 signal observations recorded as of June 2026. Key findings:

• ASN consistently resolved as LEASEWEB-USA-DAL
• Operator score: 0.0435 (minimal)
• Geographic signals from Cymru country data
• No persistent malicious activity detected (threatPersistenceDays: 0)

## Relationships

138 associated relationships identified, primarily same-network associations (LU-79). No known correlations to specific campaigns, hostnames, or organizations beyond the hosting provider.

## Recommended Security Actions

Based on risk profile, the following rules are recommended:

Firewall Rules:

• iptables: `iptables -A INPUT -s 173.234.225.181 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 173.234.225.181 drop`
• nginx: `deny 173.234.225.181;`
• Cloudflare WAF: Block with expression `ip.src eq 173.234.225.181`
• AWS WAF: Block address `173.234.225.181/32`

## Intelligence Assessment

This IP operates on shared hosting infrastructure within a high-abuse neighborhood. While the endpoint itself shows no active services or direct threat indicators, the subnet context suggests potential for misuse. The Choopa/GameServers classification indicates this may be gaming server hosting, which is commonly leveraged for abuse. Monitor inbound connection attempts; consider blocking if organizational policy restricts traffic from high-abuse density subnets.

---

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.