148.113.128.102📋 Copy

# IP Intelligence Briefing: 148.113.128.102/32

Date: 2026-06-20

Classification: MODERATE RISK / HIGH ABUSE SUBNET

Analyst: IPDebrief Intelligence

---

## Executive Summary

IP 148.113.128.102 is a cloud-hosted infrastructure address assigned to Ahrefs Pte Ltd via OVH (ASN 16276). The IP is currently firewalled with no active services and demonstrates a moderate overall risk score (50). However, the parent /24 subnet exhibits elevated abuse characteristics, with 175 threat-sibling addresses identified within the network block. The IP was recently listed on 8 DNSBLs, indicating active reputation degradation.

---

## Ownership & Geolocation

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 148.113.128.0/24
• Registered RIR: ARIN
• Geolocation: Canada (CA) / Singapore (reported)
• Service Type: Hosting / Cloud Infrastructure
• Status: Firewalled / No Open Services

---

## Threat Assessment

• Risk Score: 50 (Moderate)
• Threat Indicators: None directly associated with this IP
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• DNSBL Listings: 8 total (2 active listings)
• Operator Score: 0.2174 (Minimal)
• Persistent Malicious Activity: No (single observation only)

---

## Subnet Intelligence (148.113.128.0/24)

• Abuse Density: 0.6836 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 208
• Threat Siblings: 175
• Inherited Risk Score: 27

The subnet demonstrates concentrated threat activity, with approximately 68% of active addresses flagged as potentially malicious. This contextual risk factor should be considered when evaluating traffic from this network block.

---

## Relationship Network

• Total Relationships: 37
• Primary Association: OVH-CUST-281059693 network block
• Hosted Domain: ahrefs.net (proxy-ca014-san102.ahrefs.net)
• Forward Resolution: Confirmed to ahrefs.net DNS infrastructure
• Connection Type: Proxy CA014-SAN102

The IP is integrated into the Ahrefs proxy infrastructure, with multiple same-network relationships indicating shared hosting environment.

---

## Behavioral History

• Total Observations: 22
• Most Recent Signal: 2026-06-20 02:41:31 UTC
• Threat Observation Count: 1
• Ownership Changes: None
• Route Stability: Not Stable (route changes detected in last 30 days)

Historical data indicates minimal persistent malicious behavior. The IP was recently listed across multiple threat feeds, suggesting temporary reputation issues rather than established malicious operations.

---

## Recommended Actions

Immediate Mitigation

1. Monitor Inbound Traffic: Implement rate limiting for connections from 148.113.128.0/24 subnet

2. DNSBL Verification: Confirm current DNSBL listing status and evaluate delisting options

3. Geolocation Consistency: Investigate CA vs. Singapore geolocation discrepancy

Firewall Rules (Recommended)

```bash

# Block or rate-limit subnet due to high abuse density

iptables -A INPUT -s 148.113.128.0/24 -j DROP

# OR for monitoring:

iptables -A INPUT -s 148.113.128.0/24 -j LOG --log-prefix "HIGH_ABUSE:"

```

Observation Priority

• Monitor: Subnet-level traffic patterns from 148.113.128.0/24
• Correlate: Check for related IPs in the same /24 block
• Contextualize: Evaluate against Ahrefs proxy infrastructure baseline

---

## Conclusion

IP 148.113.128.102 presents moderate risk within a high-abuse hosting environment. While the specific address shows no direct threat indicators, the subnet's elevated abuse density (68%) warrants defensive monitoring. Traffic from this network block should be evaluated with increased scrutiny, particularly given the recent DNSBL listings and unstable routing characteristics.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.