173.234.225.192📋 Copy

# IP Intelligence Briefing: 173.234.225.192/32

Classification: Moderate Risk | Priority: Medium | Date: Current

---

## Executive Summary

IP 173.234.225.192 is a colocation hosting address operated by Leaseweb USA, Inc. (ASN 394380) in Dallas, TX. While the IP itself shows no direct threat indicators, the subnet exhibits elevated abuse density (83.59%), suggesting the infrastructure is frequently utilized for malicious activity. No open ports or active services were detected on the target IP.

---

## Technical Profile

---

## Risk Indicators

Direct Threat Signals: None. The IP is not flagged as a known attacker, spam source, or Tor exit node.

Contextual Risk Factors:

• Abuse Density: The /24 subnet (173.234.225.0/24) shows 83.59% abuse density with 214 of 256 sibling IPs classified as threats
• Inherited Risk Score: 33/100 from neighborhood context
• DNSBL Presence: Listed on 2 of 8 threat feeds, indicating prior abuse history

---

## Temporal Analysis

Observation history contains 41 signal observations. Recent assessments (June 2026) consistently report minimal operator scores (0.1739). No persistent malicious behavior detected; the IP is not classified as persistently malicious.

---

## Related Entities

113 relationships identified, primarily network-level associations (LU-79). No organizational, certificate, or hostname relationships linked to this specific address.

---

## Recommended Actions

Based on the moderate risk profile and neighborhood context, consider the following:

Blocking Recommendations:

```bash

# iptables

iptables -A INPUT -s 173.234.225.192 -j DROP

# nftables

nft add rule inet filter input ip saddr 173.234.225.192 drop

# Cloudflare WAF

action: block

expression: ip.src eq 173.234.225.192

# AWS WAF

Addresses: 173.234.225.192/32

```

Additional Considerations:

• Monitor for emergence of open ports or service banners
• Evaluate blocking adjacent high-risk siblings within the /24 subnet if traffic patterns justify it
• Review connection logs for any abuse originating from this subnet prefix (173.234.225.0/24)

---

Intelligence Source: IPDebrief | Status: Current | Action Required: Review firewall rules and monitoring thresholds

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.