173.234.225.232📋 Copy

# IP Intelligence Briefing: 173.234.225.232

Classification: Moderate Risk | Infrastructure: Colocation Hosting | Organization: Leaseweb USA, Inc. (ASN 394380)

---

## Executive Summary

IP 173.234.225.232 is a Dallas, TX-based colocation hosting endpoint operated under Leaseweb USA, Inc. (Choopa/GameServers infrastructure). The IP demonstrates moderate risk (score 50/100) with no active threat indicators, but operates within a high-abuse subnet environment (84.77% abuse density). No malicious activity has been observed directly from this endpoint.

---

## Infrastructure Profile

---

## Risk Assessment

• Overall Risk Score: 50 (Moderate)
• Provider Score: 0
• Authority Score: 0
• DNSBL Listings: 2 of 8 total lists
• Campaign Affiliation: None detected
• Campaign Likelihood: None
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

---

## Neighborhood Analysis

The IP resides in subnet 173.234.225.0/24:

• Total Siblings: 256
• Active Siblings: 184
• Threat Siblings: 217
• Abuse Density: 84.77% (High Abuse Classification)
• Inherited Risk: 33

This subnet exhibits elevated abuse prevalence. While this IP shows no direct malicious signals, the high concentration of threat-adjacent siblings warrants contextual awareness during incident correlation.

---

## Observed Behavior (History)

• Total Observations: 39
• Recent Activity: Multiple observations on June 18-19, 2026
• Operator Score Trend: Consistent minimal score (0.1304)
• Threat Persistence: 0 days
• Ownership Changes: 0
• Threat Observation Count: 1

Behavioral indicators suggest stable, non-malicious operation with no escalation patterns.

---

## Relationship Graph

• Total Relationships: 147
• Primary Classification: Same Network (LU-79)
• Associated Networks: LU-79 (multiple entries)
• No Cross-Organization Links: Relationships confined to network-level associations

---

## Recommended Actions

1. Monitoring: No immediate blocking required. IP demonstrates benign operational patterns.

2. Contextual Awareness: Monitor subnet 173.234.225.0/24 for correlated activity given 84.77% abuse density.

3. Inbound Filtering: No specific firewall rules required. Standard provider-level filtering applies.

4. Log Review: Review logs for any outbound connections from your environment to this IP.

5. Re-evaluation: Reassess if network activity patterns change or if the IP appears in threat feeds.

---

## Conclusion

IP 173.234.225.232 is a legitimate colocation hosting endpoint with no observed malicious activity. The moderate risk score reflects the hosting infrastructure's association with the Choopa/GameServers provider ecosystem and the high-abuse subnet environment. Current observation history indicates stable, non-threatening behavior. SOC teams should maintain awareness of the subnet's elevated abuse density but no immediate blocking action is warranted.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.