141.94.123.106📋 Copy

# IP Intelligence Briefing: 141.94.123.106/32

Classification: Moderate Risk | Date: Current | Analyst: IPDebrief SOC

## Executive Summary

IP address 141.94.123.106 is a cloud VPS endpoint hosted by OVH SAS (ASN 16276) in Roubaix, France. The IP exhibits moderate risk characteristics with a risk score of 55 and demonstrates multiple DNSBL listings across three of eight monitored lists. Open RDP connectivity and neighborhood threat indicators warrant monitoring and potential firewall restriction.

## Infrastructure Profile

• Organization: OVH SAS (OVH SAS)
• Network: VPS-EU-WEST-RBX-VPS-1 (141.94.123.0/24)
• Geolocation: Roubaix, France (FR)
• Infrastructure Type: CloudCompute / VPS Hosting
• DNS Resolution: vps-a77076d6.vps.ovh.net
• Network Classification: Cloud, Hosting, Non-Residential

## Risk Assessment

## Threat Indicators

• Blacklist Status: Listed on 3 of 8 threat feeds
• Maximum Severity: High
• Tor/Proxy: No
• Known Attacker: No
• Spam Source: No
• Campaign Association: None detected

## Network Exposure

• Open Ports: TCP/3389 (RDP)
• Service Purpose: Single-Service Host
• DNSSEC: Valid
• IPv4/IPv6: IPv4 Only

## Temporal Analysis

• Observation Count: 18 historical signals
• Ownership Changes: None
• Threat Persistence: 0 days
• Route Stability: Unstable (route changes detected)
• Recent Activity: Multiple observations confirm persistent cloud hosting classification

## Neighborhood Analysis (141.94.123.0/24)

• Subnet Abuse Density: 0.3333 (33%)
• Subnet Classification: Mostly Clean
• Total Siblings: 3
• Active Siblings: 2
• Threat Siblings: 1
• Neighbor Risk Distribution: 2 Medium, 0 High, 0 Low
• Identified Neighbors:

- 141.94.123.104 (Risk: 55, Authority: 60)

- 141.94.123.108 (Risk: 55, Authority: 60)

## Intelligence Relationships

• DNS Associations: vps-a77076d6.vps.ovh.net (multiple records)
• Network Association: VPS-EU-WEST-RBX-VPS-1
• Total Relationships: 21

## Recommended Actions

Based on the risk profile and exposure analysis, the following actions are recommended:

1. Block RDP Access: Restrict or monitor TCP/3389 inbound traffic to mitigate remote access exploitation risk

2. Monitor DNSBL Listings: Investigate the three blacklist listings to determine source of reputation degradation

3. Subnet-Level Monitoring: Correlate traffic patterns with neighbor IPs (141.94.123.104, 141.94.123.108) due to shared abuse density

4. Traffic Analysis: Implement logging for outbound connections to understand potential command-and-control or lateral movement patterns

## SOC Analyst Notes

This IP represents a shared OVH VPS infrastructure with elevated risk indicators. The open RDP port combined with DNSBL listings suggests potential misconfiguration or compromise. While no active attacks were identified, the neighborhood abuse density of 33% indicates this subnet warrants continued monitoring. Recommend blocking unsolicited inbound connections and implementing egress filtering.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.