173.234.226.173📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 173.234.226.173/32

Classification: Moderate Risk

Date: Current Analysis

Prepared For: SOC Operations Team

---

## EXECUTIVE SUMMARY

IP address 173.234.226.173 is a colocation hosting resource operated by Choopa/GameServers under Leaseweb USA, Inc. (ASN 394380). The address exhibits moderate risk characteristics (risk score: 50) with evidence of DNSBL listing (2 of 8 lists). The broader /24 subnet demonstrates high abuse density (0.8945) with 229 threat-sibling IPs among 256 active addresses. No active malicious campaigns or known attacker indicators associated with this specific IP.

---

## OWNERSHIP & INFRASTRUCTURE

---

## THREAT INDICATORS

• Risk Score: 50 (Moderate)
• Abuse Confidence: Not quantified
• DNSBL Status: Listed on 2 of 8 threat feeds
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Active Campaigns: None identified

---

## SUBNET CONTEXT: 173.234.226.0/24

• Abuse Density: 0.8945 (High)
• Active Siblings: 226 of 256
• Threat Siblings: 229
• Inherited Risk: 35
• Risk Distribution: 100 medium-risk neighbors, 0 high/low

The /24 subnet exhibits consistent medium-risk classification across the neighborhood, suggesting systematic abuse patterns or misconfiguration within the hosting infrastructure.

---

## OBSERVATION HISTORY

Fourteen observations recorded over the past 48 hours, with operator scores consistently at 0.1304. No escalation in threat signals detected. The IP maintains stable ownership with no recent changes.

---

## NETWORK RELATIONSHIPS

121 relationship entries identified, primarily "Same Network" associations with LU-79 network designation. No cross-organization or certificate-based relationships detected.

---

## RECOMMENDED ACTIONS

Immediate Mitigation: Block traffic from this IP address due to DNSBL presence and moderate risk profile.

Platform-Specific Rules:

```bash

# iptables

iptables -A INPUT -s 173.234.226.173 -j DROP

# nftables

nft add rule inet filter input ip saddr 173.234.226.173 drop

# Nginx

deny 173.234.226.173;

# pfSense

173.234.226.173/32

# Cloudflare WAF

{"description":"Block 173.234.226.173 — IPDebrief risk score 50","action":"block","filter":{"expression":"ip.src eq 173.234.226.173"}}

# AWS WAF

{"Addresses":["173.234.226.173/32"],"Description":"IPDebrief risk 50"}

```

---

## ASSESSMENT

This IP represents a moderate-risk colocation host within a high-abuse-density subnet. While no active malicious indicators are present, the DNSBL listings and subnet context warrant defensive blocking. Consider monitoring for lateral activity to neighboring IPs in the /24 if this address becomes actively blocked.

Priority: MEDIUM

Action Required: Block at perimeter firewall/WAF

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.