173.234.226.140📋 Copy

# IP INTELLIGENCE BRIEFING: 173.234.226.140/32

## Executive Summary

IP address 173.234.226.140 is a moderate-risk (score: 50) colocation hosting IP from Leaseweb USA, Inc. (ASN 394380), operating in Dallas, TX. The IP is associated with Choopa/GameServers infrastructure and shows no active threat indicators despite operating within a high-abuse density subnet (0.7266).

## Infrastructure Profile

• Organization: Leaseweb USA, Inc.
• ASN: 394380
• Location: Dallas, TX, US (2500km accuracy radius)
• Infrastructure Type: Colocation Hosting
• Network Role: Firewalled / No Services
• DNS: No PTR records; forward resolution unconfirmed
• Services: No open ports detected; TLS certificates not observed

## Threat Assessment

• Risk Score: 50/100 (Moderate)
• Abuse Confidence: Not quantified
• Threat Indicators: None detected
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Tor/Proxy/VPN: Not identified
• Known Attacker: No
• Spam Source: Not identified

## Neighborhood Context

The /24 subnet (173.234.226.0/24) exhibits elevated abuse characteristics:

• Abuse Density: 0.7266 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 236
• Threat-Sibling Count: 186
• Risk Distribution: 100 medium-risk neighbors; zero high-risk neighbors

This indicates the IP resides in a high-density hosting environment with significant peer abuse activity, though the target IP itself shows no elevated malicious signals.

## Observational History

Forty-three signal observations recorded. Historical data shows minimal persistent activity with no evidence of evolving threat behavior. No sustained malicious campaigns detected.

## Relationship Graph

144 relationships identified, predominantly "Same Network" associations with LU-79 network. No certificate or hostname relationships observed.

## Recommended Actions

Based on the risk profile, the following firewall rules are recommended:

## Assessment Notes

Despite moderate risk scoring, the IP shows no active exploitation patterns. The elevated neighborhood abuse density warrants contextual consideration—this IP operates in a hosting environment with significant peer abuse activity. Blocking is recommended due to DNSBL listings and moderate risk classification, though the absence of active threat indicators suggests opportunistic rather than targeted behavior.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.