173.234.226.210📋 Copy

# IP Intelligence Briefing: 173.234.226.210

## Executive Summary

IP 173.234.226.210 is classified as a Moderate Risk address (risk score: 50) hosted on a colocation hosting platform. The IP belongs to Leaseweb USA, Inc. (ASN: 394380) in Dallas, TX. While the IP itself shows no active threat indicators, it operates within a high-abuse-density subnet (173.234.226.0/24) with an abuse density of 0.7344 and 188 threat-identified siblings. The address is currently firewalled with no open services detected.

---

## Profile Details

Ownership & Registration

• ASN: 394380 (Leaseweb USA, Inc.)
• Organization: Leaseweb USA, Inc.
• CIDR Block: 173.234.226.0/24
• RIR: ARIN
• Network Type: Colocation Hosting
• Provider Classification: Choopa/GameServers

Geolocation

• Country: US
• Region: TX
• City: Dallas
• Geo Consensus: True (2 sources)
• Validation Status: ICMP blocked – unable to validate

Control Plane

• Origin ASN: 394380
• BGP Prefix: 173.234.226.0/24
• AS Path: 3257 394380
• Route Stability: Stable (0 route changes in 30 days)
• DNSSEC Valid: True
• Has CAA: True

---

## Threat Indicators

Key Observations

• No active threat indicators or known campaigns
• DNSBL listings indicate prior reputation issues
• Abuse confidence score not available

---

## Network Neighborhood Analysis

Subnet: 173.234.226.0/24

Risk Distribution: 100 medium-risk IPs, 0 high-risk IPs

The subnet exhibits elevated abuse activity, with 188 out of 256 sibling IPs flagged as threats. This suggests the hosting infrastructure is commonly exploited for malicious purposes.

---

## Historical Analysis

Total Observations: 54

Recent signal activity indicates:

• Consistent classification as Choopa/GameServers hosting
• DNSBL listings with high-severity ratings
• Operator score fluctuations (0.2609–0.4783)
• Network classification stability (is_hosting: true)

No persistent malicious activity observed, but historical DNSBL presence warrants attention.

---

## Relationship Graph

Total Relationships: 197

• Multiple same-network associations (LU-79 network segment)
• No certificate or hostname relationships detected
• No related organizations or subnets beyond same-network peers

---

## Services & DNS

Note: Services appear firewalled or inactive.

---

## Recommended Actions

Based on the moderate risk profile and subnet abuse history, the following defensive measures are recommended:

Firewall Rules

iptables:

```

iptables -A INPUT -s 173.234.226.210 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 173.234.226.210 drop

```

nginx:

```

deny 173.234.226.210;

```

Cloudflare WAF:

```json

{

"description": "Block 173.234.226.210 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 173.234.226.210"

}

}

```

AWS WAF:

```json

{

"Addresses": ["173.234.226.210/32"],

"Description": "IPDebrief risk 50"

}

```

---

## Intelligence Assessment

This IP represents a low-to-moderate threat suitable for defensive blocking. Key factors supporting this assessment:

1. Hosting Infrastructure: IP operates on a colocation platform commonly used for both legitimate and malicious purposes

2. Abuse Environment: High-abuse subnet with significant threat sibling activity

3. Clean Current Profile: No active attacker indicators or known campaigns

4. Historical DNSBL Presence: Prior reputation issues suggest previous abuse or misconfiguration

Recommended Action: Implement block rules while monitoring for legitimate service requirements. Consider broader subnet-level filtering (173.234.226.0/24) if the organization experiences related attack patterns from the subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.