173.234.227.20📋 Copy

# IPDEBRIEF THREAT INTELLIGENCE BRIEFING

Target IP: 173.234.227.20/32

Classification: Moderate Risk Hosting Infrastructure

Date: 2026-06-19

---

## EXECUTIVE SUMMARY

IP 173.234.227.20 operates as hosting infrastructure under Choopa/GameServers (Leaseweb USA, Inc.) within the Dallas, TX colocation network. The IP presents moderate risk (score: 50) with no active threat indicators, but resides in a subnet exhibiting critical abuse density (0.9336). Recommended for monitoring or blocking depending on organizational threat tolerance.

---

## OWNERSHIP & GEOLOCATION

• Organization: Leaseweb USA, Inc.
• ASN: 394380
• CIDR Block: 173.234.227.0/24
• Location: Dallas, Texas, United States (ARIN)
• Infrastructure Type: Colocation Hosting
• Provider Classification: Choopa/GameServers

---

## NETWORK CLASSIFICATION

• Role: Hosting/Colocation Provider
• Service Status: Firewalled/No Active Services
• Open Ports: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0

---

## THREAT ASSESSMENT

Risk Score: 50/100 (Moderate)

Key Indicators:

• No active threat indicators detected
• No known campaigns or correlated IPs
• Pulsedive risk assessment: Not applicable
• DNSBL listings: 2 of 8 total lists (limited contamination)

Historical Context:

• 52 observations recorded
• Consistent operator score: 0.4783 (Basic)
• Ownership stability: 0 changes
• Threat persistence: 0 days (not persistently malicious)

---

## SUBNET ENVIRONMENT ANALYSIS (173.234.227.0/24)

Critical Finding: Subnet exhibits extreme abuse density

Implication: This IP operates within a subnet with 93% abuse density. While this specific IP shows no active threat indicators, the neighborhood environment suggests elevated risk of collateral activity or shared infrastructure.

---

## RELATIONSHIP MAPPING

152 relationships identified, primarily same-network connections (LU-79 network references). No external organization, hostname, or certificate relationships detected.

---

## RECOMMENDED ACTIONS

Firewall/Network Blocking

```bash

# iptables

iptables -A INPUT -s 173.234.227.20 -j DROP

# nftables

nft add rule inet filter input ip saddr 173.234.227.20 drop

# pfSense

173.234.227.20/32

```

WAF Rules

• Cloudflare WAF: Block IP — Risk score 50
• AWS WAF: 173.234.227.20/32 (Description: IPDebrief risk 50)

SOC Analyst Guidance

1. Block if: Internal assets have received traffic from this IP

2. Monitor if: No direct impact but subnet abuse density warrants observation

3. Allow if: Legitimate business relationship exists with Choopa/GameServers infrastructure

4. Note: Full /24 subnet blocking may be warranted given 0.93 abuse density

---

## INTELLIGENCE JUDGMENT

Threat Level: MODERATE

Action Priority: MEDIUM

Confidence: 0.85

The IP represents standard hosting infrastructure with no active malicious indicators. However, the extreme abuse density of the parent subnet (173.234.227.0/24) elevates the operational risk profile. Recommend blocking at perimeter unless business justification exists, or implementing rate limiting with close monitoring of traffic patterns.

---

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.