173.234.227.34📋 Copy

# IP Intelligence Briefing: 173.234.227.34/32

## Executive Summary

IP address 173.234.227.34 is classified as Moderate Risk (Score: 50) with a network-level abuse density of 0.8359 (high_abuse). The address belongs to Leaseweb USA, Inc. (ASN 394380) and is associated with Choopa/GameServers infrastructure in Dallas, TX. The subnet exhibits sustained high abuse activity with 214 of 256 total sibling IPs flagged as threats.

## Threat Profile

Infrastructure Classification:

• Provider: Leaseweb USA, Inc.
• ASN: 394380
• Network Role: Colocation Hosting / Choopa GameServers
• Service Status: Firewalled / No Services
• DNSBL Listings: 2 of 8 total lists

Geolocation:

• Country: United States
• Region: Texas
• City: Dallas
• Accuracy Radius: 2500km (geo validation limited due to ICMP blocking)

## Risk Assessment

Current Risk Score: 50/100

• No direct threat indicators detected (not known attacker, not Tor exit, not spam source)
• No active campaigns or certificate matches
• DNSBL presence indicates prior reputation issues

Subnet Context (173.234.227.0/24):

• Abuse Density: 0.8359 (high_abuse classification)
• Active Siblings: 187 of 256 total IPs
• Threat Siblings: 214 of 256 total IPs
• Inherited Risk Score: 33
• All sampled neighbors show risk score of 50

Temporal Analysis:

• 48 historical observations tracked
• Consistent operator score of 0.3913 (Basic) across observation window
• No persistent malicious activity detected (threatPersistenceDays: 0)
• Route stability confirmed

## Related Entities

Network Relationships:

• Multiple associations with network LU-79
• BGP Prefix: 173.234.227.0/24
• AS Path: 3257 → 394380
• RPKI State: Not reported
• RIR Registry: ARIN

## Recommended Actions

Immediate Mitigation:

```bash

# iptables

iptables -A INPUT -s 173.234.227.34 -j DROP

# nftables

nft add rule inet filter input ip saddr 173.234.227.34 drop

# Cloudflare WAF

{"description":"Block 173.234.227.34", "action":"block", "filter":{"expression":"ip.src eq 173.234.227.34"}}

# AWS WAF

{"Addresses":["173.234.227.34/32"], "Description":"IPDebrief risk 50"}

```

Rationale:

• High subnet abuse density warrants blocking at perimeter
• No open services detected reduces exploitation risk, but reputation issues suggest prior malicious activity
• Consider blocking entire /24 subnet if threat correlation justifies broader mitigation

## Intelligence Notes

This IP resides in a high-abuse colocation hosting environment typical of game server operations. The absence of open ports and TLS certificates suggests the address may be used for infrastructure that is intentionally closed or misconfigured. The consistent high abuse density across the subnet indicates systemic risk rather than isolated incident. Monitoring for correlation with other Choopa/GameServers IPs is recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.