173.234.225.87📋 Copy

## IP Intelligence Briefing: 173.234.225.87/32

Classification: Moderate Risk (Score: 50/100)

Date: Current Analysis

Source: IPDebrief Intelligence Platform

---

Executive Summary

IP 173.234.225.87 is a hosting infrastructure address owned by Leaseweb USA, Inc. (ASN 394380), located in Dallas, TX. The IP is classified as Choopa/GameServers colocation hosting with no active services. While the individual IP shows moderate risk, the /24 subnet exhibits high abuse density (0.8359) with 214 of 256 sibling IPs flagged as threats. No current active threat indicators detected.

---

Network Profile

---

Technical Observations

• Services: No open ports detected; service banner indicates "Firewalled / No Services"
• DNS: No forward resolution; no PTR hostnames; zero hosted domains
• Email: No SPF/DMARC records; no email authentication configured
• TLS/HTTP: No TLS certificate; no HTTP headers detected
• DNSBL Status: Listed on 2 of 8 total DNSBL lists
• BGP Route: Origin ASN 394380; prefix 173.234.224.0/22; route stability flagged as false
• ICMP: Blocked during validation probe

---

Threat Intelligence

• Threat Indicators: None detected
• Tor/Proxy: Not identified as Tor exit node, proxy, or VPN
• Known Attacker: No matches in known attacker databases
• Spam Source: Not flagged
• Campaign Affiliation: No known campaign matches
• Persistence: Single threat observation; not persistently malicious
• Reputation Sources: None active

---

Neighborhood Analysis (173.234.225.0/24)

The subnet exhibits elevated abuse activity consistent with shared hosting infrastructure. Neighbor IPs show uniform risk scoring (50/100), indicating systematic risk characteristics across the /24 block.

---

Historical Trends

39 total observations recorded. Recent signal history (June 2026) shows consistent "Minimal" operator score (0.1304) across multiple measurements. No significant risk escalation detected over the observation period.

---

Relationship Graph

142 relationships identified, primarily "Same Network" associations (LU-79 network references). Strong network-level clustering observed within the hosting infrastructure.

---

Recommended Security Actions

Assessment: Block recommended based on moderate risk score and high-abuse subnet classification.

Firewall Rules:

• iptables: `iptables -A INPUT -s 173.234.225.87 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 173.234.225.87 drop`
• nginx: `deny 173.234.225.87;`
• pfSense: `173.234.225.87/32`
• Cloudflare WAF: Block IP 173.234.225.87 (Risk Score: 50)
• AWS WAF: Add IPSet entry 173.234.225.87/32

Note: Recommendations are probabilistic. Combine with additional threat signals before implementation.

---

Analyst Notes: This IP represents shared hosting infrastructure within a high-abuse-density subnet. While individual IP risk is moderate, the neighborhood context suggests potential for abuse. Monitor for any service activation or behavioral changes that would warrant escalated response.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.