173.234.227.166📋 Copy

# INTELLIGENCE BRIEFING: 173.234.227.166/32

Classification: Moderate Risk / High-Abuse Subnet Environment

---

## EXECUTIVE SUMMARY

IP 173.234.227.166 is a moderate-risk address (Risk Score: 50) located in Dallas, TX, US, hosted by Leaseweb USA, Inc. (ASN: 394380). The IP operates within a high-abuse density subnet (173.234.227.0/24) with abuse density of 0.7969, where 204 of 243 active siblings have been classified as threats. Despite the subnet-level risk, this specific IP shows no active threat indicators, no open services, and no known malicious campaigns.

---

## HOSTING INFRASTRUCTURE PROFILE

Organization: Leaseweb USA, Inc.

ASN: 394380

Network Type: Colocation Hosting / Choopa/GameServers

Classification: Firewalled / No Services Detected

Geolocation: Dallas, TX, US (2,206 km from probe location)

DNSSEC: Validated

Route Stability: Unstable (false)

Key Attributes:

• Infrastructure type: Colocation hosting environment
• Service status: No open ports or services detected
• Email authentication: SPF/DMARC not configured
• DNSBL listings: 2 out of 8 total lists

---

## THREAT ASSESSMENT

Current Risk Score: 50 (Moderate)

Abuse Confidence: Not applicable (no active threats)

Known Campaigns: None

Blacklist Status: Clean (0 blacklists)

Threat Indicators: None detected

Behavioral Indicators:

• Not a Tor exit node
• Not a known attacker or spam source
• No honeypot hits
• No enumeration strikes
• Not persistently malicious (threat observation count: 1)

---

## NETWORK CONTEXT: SUBNET 173.234.227.0/24

Abuse Density: 0.7969 (High Abuse Classification)

Total Siblings: 256

Active Siblings: 243

Threat Siblings: 204

Risk Distribution in Subnet:

• High Risk: 0
• Medium Risk: 100
• Low Risk: 0

Assessment: The /24 subnet exhibits pervasive abuse characteristics. Of 243 active neighbors, 204 are classified as threats. This indicates a colocation environment with significant abuse activity across multiple addresses.

---

## OBSERVATION HISTORY

Total Observations: 47 signals recorded

Recent Activity: Multiple observations recorded in June 2026

Operator Score: Minimal across recent observations

Threat Persistence: Single threat observation event

Status: No persistent malicious behavior detected

The IP has been actively observed but shows no consistent malicious pattern. Recent signals indicate minimal operator-level risk.

---

## RELATIONSHIP ANALYSIS

Total Relationships: 161 detected

Primary Connection: LU-79 network infrastructure

Network Affiliation: Multiple same-network relationships to LU-79 infrastructure

The IP maintains extensive relationships within the broader 173.234.227.0/24 network infrastructure, indicating shared routing and infrastructure with multiple related addresses.

---

## RECOMMENDED ACTIONS

Default Action: Block (based on risk score and subnet abuse density)

Firewall Rules:

• iptables: `iptables -A INPUT -s 173.234.227.166 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 173.234.227.166 drop`
• nginx: `deny 173.234.227.166;`
• pfSense: Add `173.234.227.166/32` to block list
• Cloudflare WAF: Block with expression `ip.src eq 173.234.227.166`
• AWS WAF: Add `173.234.227.166/32` to IP set

Decision Context: While the IP itself shows no active threats, the high-abuse subnet environment (0.7969 density) and 204 threat siblings suggest defensive blocking is appropriate for inbound traffic. Monitor for service activation or threat indicator emergence.

---

Analysis Timestamp: 2026-06-24

Data Sources: IPDebrief Intelligence Platform

Confidence Level: High (comprehensive multi-source validation)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.