173.234.225.219📋 Copy

# IP Intelligence Briefing: 173.234.225.219/32

## Executive Summary

IP address 173.234.225.219 is a colocation hosting resource operated by Leaseweb USA, Inc. (AS394380) in Dallas, Texas. The IP carries a Moderate Risk score of 50 with evidence of DNSBL listing (2 of 8 lists) and is situated in a high-abuse density subnet (173.234.225.0/24) where 84.77% of active IPs show abuse indicators. The infrastructure is firewalled with no publicly accessible services.

## Ownership and Geolocation

• Organization: Leaseweb USA, Inc.
• ASN: 394380 (Choopa/GameServers)
• Network Role: Colocation Hosting / Game Server Provider
• Location: Dallas, Texas, US
• Infrastructure Classification: Colocation Hosting (not CDN, cloud, or proxy)

## Threat Indicators

• DNSBL Status: Listed on 2 of 8 DNSBL feeds
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Correlation: None detected
• Threat Persistence: 0 days observed

## Network Behavior Analysis

• Service Status: No open ports detected; infrastructure is firewalled
• DNS Resolution: No forward resolution confirmed; no PTR records
• Email Reputation: No SPF or DMARC records configured
• Route Stability: BGP prefix shows 0 route changes in last 30 days but marked as not stable

## Subnet Neighborhood Assessment (173.234.225.0/24)

• Abuse Density: 0.8477 (high_abuse classification)
• Active Siblings: 184 of 256 total IPs
• Threat Siblings: 217 IPs flagged as threats
• Risk Distribution: 100 medium-risk IPs, 0 high-risk, 0 low-risk
• Inherited Risk Score: 33 (from subnet context)

## Historical Observations

47 total observations recorded with recent activity on June 18-19, 2026. DNS operator score consistently rated at 0.2174 (Minimal). Multiple blacklist listings detected with high-severity categorizations.

## Relationship Graph

169 relationships identified, all categorized as "Same Network" relationships (LU-79), indicating strong correlation with other IPs within the same /24 subnet.

## Recommended Actions

Firewall Rules:

• iptables: `iptables -A INPUT -s 173.234.225.219 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 173.234.225.219 drop`
• nginx: `deny 173.234.225.219;`
• pfsense: Block 173.234.225.219/32
• Cloudflare WAF: Block expression `ip.src eq 173.234.225.219`
• AWS WAF: Add address `173.234.225.219/32`

## Analyst Notes

This IP resides in a high-abuse density subnet where 217 of 256 total IPs show threat indicators. While the individual IP shows no open services and is firewalled, its location within a heavily abused /24 network suggests potential for abuse-related activity. The moderate risk score reflects DNSBL listings rather than active attack signatures. Consider blocking at the network edge due to neighborhood risk context, but monitor for actual malicious activity rather than relying solely on IP reputation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.