148.113.130.220📋 Copy

# IP Intelligence Briefing: 148.113.130.220

Classification: Moderate Risk | Status: Active Infrastructure

## Executive Summary

IP 148.113.130.220 operates as a cloud-based hosting resource under OVH infrastructure (ASN 16276). The IP presents moderate risk (score 50) with no active threat indicators detected. Geolocation data reveals significant inconsistencies that warrant validation. The subnet exhibits high abuse density (0.6055), suggesting elevated risk from neighboring addresses.

## Ownership and Infrastructure

## Geolocation Analysis

The IP's geolocation data contains a critical validation failure:

• Reported Location: Singapore (6082 km from Canada)
• Country Code: CA (Canada)
• Validation Status: INVALID
• Evidence: Round-trip time (RTT) of 27ms contradicts the 121.6ms minimum required for 6082km distance. This geolocation violation suggests either spoofed data or routing anomalies.

Recommendation: Correlate with additional geolocation sources and validate physical location against known infrastructure deployments.

## DNS Resolution

## Network Risk Profile

## Subnet Context (148.113.130.0/24)

• Abuse Density: 0.6055 (High)
• Classification: high_abuse
• Active Siblings: 163 of 256
• Threat Siblings: 155
• Neighborhood Risk: Elevated risk inherited from subnet abuse patterns

## Historical Observations

Signal history reveals 20 observations with key patterns:

• Most Recent: 2026-06-28 (Cloud infrastructure classification, confidence 0.90)
• Previous: 2026-06-20 (Geolocation observations showing Canada)
• Threat Persistence: 0 days
• Persistence Classification: Not persistently malicious

## Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Feeds: None
• Known Campaigns: None

## Recommended Actions

1. Monitor Neighbor IPs: The subnet (148.113.130.0/24) shows high abuse density. Review adjacent IPs for correlated malicious activity.

2. Validate Geolocation: Investigate the Singapore/Canada geolocation discrepancy through additional probing or collaboration with upstream providers.

3. Traffic Baseline: Establish baseline traffic patterns given the firewalled status and lack of open services.

4. DNSBL Monitoring: Track the 2 DNSBL listings for changes that may indicate emerging reputation issues.

## Conclusion

IP 148.113.130.220 represents a cloud hosting resource with moderate risk characteristics. While no active threat indicators are present, the subnet's high abuse density and geolocation validation failures warrant ongoing monitoring. No immediate blocking is recommended, but maintain awareness of neighborhood risk patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.