173.234.226.138📋 Copy

## IPDEBRIEF INTELLIGENCE BRIEFING

Target: 173.234.226.138/32

Classification: Moderate Risk - High-Abuse Subnet

Date: 2026-06-19

---

EXECUTIVE SUMMARY

The IP address 173.234.226.138 operates within a high-abuse density subnet (173.234.226.0/24) hosted by Leaseweb USA, Inc. (ASN 394380) in Dallas, Texas. While the specific IP shows no active threat indicators, neighborhood analysis reveals 89.45% abuse density with 229 of 256 sibling IPs classified as threats. The IP is associated with Choopa/GameServers infrastructure, typical for hosting shared environments where abuse is prevalent.

---

RISK PROFILE

---

THREAT INTELLIGENCE

Positive Indicators:

• No active threat indicators detected (not known attacker, not spam source)
• Not a Tor exit node or proxy
• No open ports detected (firewalled/no services)
• Routing stable with consistent ASN attribution
• Ownership history shows 0 changes

Negative Indicators:

• Subnet classified as "high_abuse" with 0.8945 abuse density
• 229 threat siblings in /24 neighborhood (89% threat ratio)
• Listed on 2 DNSBL lists
• Provider (Choopa/GameServers) historically associated with shared hosting abuse

---

NEIGHBORHOOD ANALYSIS

Subnet: 173.234.226.0/24

Total Siblings: 256

Active Siblings: 226

Threat Siblings: 229

Risk Distribution: 100 Medium, 0 High, 0 Low

The subnet demonstrates systemic abuse patterns, suggesting compromised infrastructure or shared hosting environments frequently exploited for malicious activity.

---

OBSERVATION HISTORY

41 observations recorded since 2026-06-18. Consistent ASN 394380 attribution with minimal operator score (0.1304) across all timeframes. No significant changes in geolocation or ownership detected.

---

RELATIONSHIP MAPPING

129 relationships identified, predominantly same-network associations (LU-79 network segment). No external correlations to organizations, hostnames, or certificates.

---

RECOMMENDED ACTIONS

Security Controls Required:

Recommendation: Block at perimeter firewall/WAF level due to high-abuse subnet context. Monitor for lateral movement if compromise is confirmed.

---

INTELLIGENCE NOTES

• No active services detected on target IP
• No specific campaigns or correlated IPs identified
• Consider subnet-level blocking (173.234.226.0/24) if threat volume warrants
• Provider infrastructure typically hosts multiple game servers and shared hosting environments

Status: Actionable block recommendation generated.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.