173.234.227.99📋 Copy

# IP INTELLIGENCE BRIEFING: 173.234.227.99/32

## Executive Summary

IP address 173.234.227.99 is a colocation hosting infrastructure endpoint operated by Leaseweb USA, Inc. (ASN 394380) in Dallas, TX. The IP carries a moderate risk score of 50 and is associated with Choopa/GameServers infrastructure. The /24 neighborhood (173.234.227.0/24) exhibits high abuse density (0.9453), with 242 of 256 total siblings flagged as threats.

## Infrastructure Profile

• Organization: Leaseweb USA, Inc.
• ASN: 394380
• Geolocation: Dallas, TX, US
• Network Role: Colocation hosting infrastructure, firewalled/no active services detected
• BGP Prefix: 173.234.224.0/22 (unstable routing)
• DNSBL Listings: 2 of 8 total lists

## Threat Indicators

• Threat Classification: Moderate Risk (Score: 50)
• Operator Score: 0.1304 (Minimal)
• Known Attacker: No
• Tor Exit Node: No
• Proxy/VPN: No
• Abuse Confidence: Not explicitly quantified
• Historical Threat Observations: 1

## Neighborhood Analysis

The /24 subnet shows elevated risk characteristics:

• Total Siblings: 256 IPs
• Active Siblings: 205
• Threat Siblings: 242 (94.4% threat rate)
• Subnet Classification: High abuse
• Inherited Risk Score: 37

Sampled neighbors (173.234.227.0-5) consistently show risk scores of 50, indicating systematic risk across the subnet rather than isolated incidents.

## Behavioral Observations

• Total Observations: 42 signals over observation period
• Recent Activity: Consistent "Minimal" operator score readings (0.1304) across multiple observations
• Threat Persistence: 0 days
• Ownership Changes: 0
• Service Exposure: No open ports; firewalling detected

## Recommended Security Actions

Based on the risk profile and neighborhood context, the following controls are recommended:

## Intelligence Notes

1. Infrastructure Context: This IP is part of a GameServers/colocation hosting environment. Many abuse activities originate from such infrastructure due to multi-tenant arrangements.

2. Subnet Risk: The high abuse density (0.9453) suggests this /24 is actively exploited. Consider subnet-level filtering if operational requirements permit.

3. No Active Services: Current scans show no open ports, suggesting either firewall protection or dormant state.

4. Monitoring Recommendation: Monitor for service activation (open ports) which would indicate exploitation.

## Classification

Risk Level: Moderate

Action Priority: Medium

Recommended Control: Block at perimeter firewall; monitor for service changes

---

*Intelligence generated from IPDebrief analysis platform. Data reflects current network state and should be combined with additional threat signals before enforcement.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.