173.234.227.86📋 Copy

## IP Intelligence Briefing: 173.234.227.86/32

Classification: Moderate Risk | Last Updated: June 19, 2026

---

Executive Summary

IP address 173.234.227.86 is a colocation hosting address operated by Leaseweb USA, Inc. (ASN 394380) located in Dallas, Texas. The address exhibits moderate risk characteristics with a risk score of 50. While no active threat indicators were identified at the time of analysis, the IP resides in a high-abuse density subnet (173.234.227.0/24) with an abuse density score of 0.9453. No open services or active ports were detected.

---

Infrastructure Profile

• Organization: Leaseweb USA, Inc.
• ASN: 394380
• Network Range: 173.234.224.0/22 (BGP Prefix)
• Geolocation: Dallas, TX, US (ARIN Registry)
• Infrastructure Type: Colocation Hosting (Choopa/GameServers)
• Network Classification: Hosting Infrastructure

---

Threat Indicators

• Risk Score: 50 (Moderate)
• Abuse Confidence Score: Not available
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Known Attack Indicators: None
• Campaign Attribution: No matches
• Tor/Proxy Detection: Not a Tor exit node, proxy, or VPN

---

Network Context & Neighborhood Analysis

The target IP resides within the 173.234.227.0/24 subnet, which demonstrates significant abuse activity:

• Total Siblings: 256 addresses
• Active Siblings: 205
• Threat Siblings: 242
• Abuse Density Score: 0.9453 (High Abuse)
• Subnet Classification: high_abuse

Risk distribution across the subnet shows 100 medium-risk addresses with no high or low-risk classifications in the sampled neighbors. This environment context suggests the IP is operating within a shared hosting infrastructure commonly utilized for legitimate gaming servers and colocation services.

---

Service & DNS Assessment

• Open Ports: None detected
• Forward Resolution: Not confirmed
• PTR Hostnames: None
• Hosted Domains: 0
• HTTP/HTTPS Services: None active
• TLS Certificates: None

The absence of open services suggests the address is either dormant, firewalled, or configured without public-facing services at the time of observation.

---

Historical Signal Analysis

Analysis of the observation history (42 total observations) reveals:

• Observation Period: June 18–19, 2026
• Operator Score: Consistently minimal (0.1304–0.15)
• Risk Trend: Stable with no escalation patterns
• Threat Persistence: 0 days
• Ownership Changes: 0

The IP has demonstrated stable behavior with no observed degradation in reputation over the monitoring window.

---

Network Relationships

The IP exhibits 120 documented relationships, including multiple same-network associations with network identifier LU-79. These relationships indicate the address is part of an established hosting network infrastructure with peer addresses in the same organizational network.

---

Recommended Actions

Based on the moderate risk classification and hosting infrastructure profile:

1. Allow Traffic: Permissive policy recommended for inbound/outbound traffic given the hosting nature and lack of active threats

2. Monitor Subnet: Implement monitoring for the 173.234.227.0/24 subnet due to high abuse density

3. DNSBL Validation: Verify application against 2 DNSBL listings if email traffic is relevant

4. No Immediate Blocking: No actionable threat indicators warranting immediate mitigation

---

Analysis Complete.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.