148.113.203.117📋 Copy

# IP Intelligence Briefing: 148.113.203.117/32

Classification: LOW RISK

Date Generated: 2024

---

## Executive Summary

IP address 148.113.203.117 is a low-risk cloud compute endpoint hosted on OVH Hosting infrastructure in Canada. The IP resolves to a VPS hostname and presents standard web server services with no active threat indicators. Neighborhood analysis shows zero abuse density across the /24 subnet.

---

## Network Infrastructure

• IP Address: 148.113.203.117/32
• ASN: 16276 (OVH Hosting, Inc.)
• Organization: OVH Hosting, Inc.
• CIDR Block: 148.113.202.0/23
• Country: Canada (CA)
• Infrastructure Type: CloudCompute / Hosting
• Geolocation: 43.63°N, -79.37°W

---

## Risk Assessment

Overall Risk Score: 25/100 (Low Risk)

Control Plane Indicators:

• DNSBL Listed: 1 of 8 lists
• Operator Score: 0.2609 (Basic)
• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not validated

---

## Network Services

Open Ports:

• TCP/80 (HTTP)
• TCP/443 (HTTPS)
• TCP/22 (SSH)

Server Fingerprint:

• Web Server: openresty/1.21.4.1
• TLS Certificate: CloudFlare Origin SSL Certificate Authority
• Certificate Subject: *.kaas.am, kaas.am
• Certificate Issuer: CloudFlare, Inc., California

DNS Resolution:

• PTR Hostname: vps-ca561b9e.vps.ovh.ca
• Forward Resolution: Confirmed
• Hosted Domain: ovh.ca

---

## Historical Observations (18 Total)

Recent signal activity observed on 2026-07-31 indicates:

1. Geolocation Signals: Mixed data sources showing CA/US with confidence 0.35-0.75

2. Network Attribution: ASN AS16276 (OVH SAS) detected with confidence 0.75

3. HTTP Probes: Status code 401 (Unauthorized) observed with openresty server signature

4. Ownership: Consistent OVH Hosting attribution with zero ownership changes

Temporal Analysis:

• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: No

---

## Relationship Analysis

DNS Associations:

• vps-ca561b9e.vps.ovh.ca (3 instances)

Network Associations:

• VPS-BHS6 (Same Network)

Correlated Entities: 0

Certificate Matches: 0

Banner Matches: 0

---

## Neighborhood Analysis (148.113.203.0/24)

No neighboring IPs detected within the /24 subnet.

---

## Threat Indicators

• Campaign Likelihood: Not established
• Known Campaigns: None
• Threat Feeds: No active indicators
• Abuse Feeds: No detections

---

## Recommended Actions

Current Status: No immediate blocking required

Monitoring Recommendations:

• Monitor for status code changes from 401 to 200/302
• Track SSL certificate renewals for kaas.am domains
• Observe for new port openings beyond standard web services

Firewall Rules:

• No specific rules recommended at this time
• Standard web server ports (80, 443, 22) are acceptable for OVH cloud infrastructure

---

## Intelligence Narrative

148.113.203.117 operates as a standard web hosting endpoint within OVH's Canadian infrastructure. The IP presents a low-risk profile with no threat indicators detected across multiple data sources. Historical observations show consistent hosting infrastructure behavior with no malicious activity patterns. The associated domain (kaas.am) uses CloudFlare Origin SSL certificates, indicating legitimate web service operations. Neighborhood analysis confirms zero abuse activity within the local subnet. The IP requires only standard monitoring practices and no immediate defensive action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.