173.234.227.220📋 Copy

# IP Intelligence Briefing: 173.234.227.220/32

Classification: Moderate Risk Hosting Infrastructure

Date: Intelligence Report Generated

Scope: Full Profile, Historical Analysis, Relationship Mapping, and Neighborhood Assessment

---

## Executive Summary

IP 173.234.227.220 is a colocation hosting address operated by Leaseweb USA, Inc. (ASN 394380) within Dallas, Texas. The IP presents moderate risk (score: 50) as part of a high-abuse density subnet (173.234.227.0/24) classified as "high_abuse" with 95.7% abuse density. The address shows no active malicious indicators, no open services, and maintains a stable ownership profile.

---

## Infrastructure Profile

---

## Threat Assessment

Active Threat Indicators: None detected

• Blacklist Status: 0 blacklists, 2 DNSBL entries
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not calculated

Service Exposure: No open ports detected. No TLS certificates, HTTP banners, or service signatures observed.

DNS Configuration: No PTR records, no forward resolution, zero hosted domains. Email authentication (SPF/DMARC) not configured.

---

## Neighborhood Analysis

The IP resides within subnet 173.234.227.0/24, exhibiting concerning abuse characteristics:

Risk Distribution Among Neighbors: 100 medium-risk, 0 high-risk, 0 low-risk addresses. All sampled neighbors (173.234.227.0-5) consistently show risk scores of 50 with authority scores of 50.

---

## Control Plane Data

• BGP Prefix: 173.234.224.0/22
• Route Stability: Not stable
• DNSSEC: Valid
• RPKI State: Not evaluated
• IRR Consistency: Not evaluated
• Operator Score: 0.1304 (Minimal)

---

## Historical Observation Analysis

Total Observations: 44 signals recorded over monitoring period

Temporal Trends:

• Recent observations (2026-06-18 to 2026-06-19) show consistent "Minimal" operator scoring
• No escalation in threat posture detected
• Threat persistence days: 0
• Ownership changes: 0

Signal Consistency: Multiple consecutive observations indicate stable infrastructure characteristics with no degradation in reputation metrics.

---

## Relationship Mapping

Direct Relationships: 131 identified relationships, primarily network-level associations (LU-79 network references).

Associated Entities:

• Multiple same-network relationships to LU-79 network identifiers
• No certificate, hostname, or campaign correlations detected

---

## Recommended Actions

For Network Defenders:

1. Traffic Monitoring: Monitor inbound/outbound traffic patterns given the high-abuse subnet context

2. Policy Review: Review egress filtering policies for traffic to/from this subnet

3. Blocklist Evaluation: Consider blocking at perimeter if this IP appears in threat feeds or causes issues

4. Continued Monitoring: Maintain observation; subnet abuse density warrants ongoing vigilance

Firewall/IPS Recommendations:

• No immediate blocking required based on current threat profile
• Consider geo-blocking if legitimate operations do not require Dallas, TX infrastructure
• Implement rate limiting if abuse patterns emerge from associated subnet

---

## Conclusion

IP 173.234.227.220 represents a legitimate colocation hosting address within a high-abuse density subnet. While the individual IP shows no active malicious behavior, the neighborhood context (95.7% abuse density, 245 threat siblings) suggests elevated operational risk. SOC teams should monitor traffic patterns and consider subnet-level controls given the concentration of abuse activity in this /24 range. No immediate defensive action required, but maintain situational awareness.

---

Data Source: IPDebrief Intelligence Platform

Analysis Methodology: Full profile, historical observation, relationship mapping, and neighborhood density analysis

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.