145.239.158.101📋 Copy

# THREAT INTELLIGENCE BRIEFING

Target: 145.239.158.101/32

Classification: Low Risk / Legitimate Hosting Infrastructure

Generated: 2026-06-17

---

## EXECUTIVE SUMMARY

IP address 145.239.158.101 is registered to OVH SAS (ASN 16276), a major European hosting provider. The IP demonstrates low-risk characteristics with a risk score of 30. Analysis indicates legitimate web hosting infrastructure with no active malicious indicators detected. No immediate blocking or mitigation actions are recommended.

---

## RISK ASSESSMENT

Overall Classification: LOW RISK — Standard hosting infrastructure

---

## OWNERSHIP & GEOLOCATION

• Organization: OVH SAS (ASN 16276)
• Location: Roubaix, Hauts-de-France, France (FR)
• Registration: RIR: RIPE
• Network Role: Hosting Provider (Cloud Infrastructure)
• Connection Type: Web Server

---

## NETWORK SERVICES & DNS

Open Ports:

• TCP/80 (HTTP) — nginx
• TCP/443 (HTTPS) — nginx
• TCP/22 (SSH) — OpenSSH 7.9p1 Debian-10
• TCP/8443 (HTTPS-ALT)

DNS Configuration:

• PTR Hostname: hr4282858884.reseller.mis.ovh.net
• Forward Resolution: Confirmed
• Email Authentication: SPF and DMARC configured

TLS Certificate:

• Issuer: Let's Encrypt (R13)
• Subject: hr4282858884.reseller.mis.ovh.net
• Self-Signed: No

---

## THREAT INDICATORS

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Known Campaigns: None detected
• Blacklist Count: 0
• Pulsedive Risk: N/A

Control Plane:

• Route Stability: Unstable (isRouteStable: false)
• RPKI State: N/A
• IRR Consistency: N/A
• DNSSEC Valid: Yes

---

## NETWORK NEIGHBORHOOD ANALYSIS

Subnet: 145.239.158.101/24

• Abuse Density: 1 (Low)
• Classification: Mostly Clean
• Active Siblings: 1
• Threat Siblings: 1

The IP resides in a predominantly clean subnet with minimal abuse activity. One neighboring IP shows threat indicators, suggesting localized activity rather than widespread compromise.

---

## OBSERVATION HISTORY

Total Observations: 25

Recent Activity: 2026-06-17 (HTTP/2, HTTPS)

Signal Trends:

• HTTP/2 enabled with HSTS header absent
• Response time: ~324ms (TTFB)
• RTT: 87-96ms (avg 91.8ms)
• Distance: 500.4km from claimed location
• Geo Validation: Plausible

No evidence of escalating threat behavior over the observation period.

---

## RELATIONSHIP GRAPH

Identified Associations:

• DNS Association: hr4282858884.reseller.mis.ovh.net (OVH reseller hostname)
• Network Associations: Multiple PCI-GRA3 network references

No direct associations to known malicious infrastructure.

---

## RECOMMENDED ACTIONS

Current Risk Level: LOW

Recommended Action: MONITOR — No immediate blocking required

Firewall Rules: Not recommended

WAF Rules: Not recommended

Blocking Threshold: Risk score below action threshold (30 < 50)

---

## ANALYST NOTES

IP 145.239.158.101 represents standard OVH hosting infrastructure with legitimate web server services. The single DNSBL listing is a minor concern but does not constitute actionable threat evidence. SOC analysts should monitor for changes in the threat profile, particularly given the subnet contains one threat sibling. No immediate defensive action required; continue normal traffic monitoring.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.