148.113.128.126📋 Copy

# IP Intelligence Briefing: 148.113.128.126/32

## Executive Summary

IP 148.113.128.126 is a moderate-risk address (Risk Score: 50) operating within OVH cloud infrastructure, allocated to Ahrefs Pte Ltd. The IP resolves to proxy infrastructure for ahrefs.net and demonstrates no active open ports or service banners.

## Ownership and Infrastructure

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 148.113.128.0/24
• Infrastructure Type: Cloud Compute
• Service Classification: Firewalled / No Services
• Hosting Status: Enabled

## Geolocation Discrepancy

Critical intelligence indicator: Geovalidation reveals significant inconsistencies. The IP's claimed location (Singapore, CA) contradicts observed network telemetry:

• Claimed Distance: 6,082 km
• Observed RTT: 28ms average (30.8ms avg)
• Minimum Possible RTT: 121.6ms for the claimed distance
• Validation Status: Flagged as implausible (geo_plausible: false)

This RTT violation indicates the IP may be proxying or routing through an intermediate location.

## DNS Resolution

• PTR Hostname: proxy-ca014-san126.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: 1 hostname returned
• Forward Confirmed: No (reverse DNS not validated)

## Threat Assessment

• Abuse Confidence Score: Not assigned
• Blacklist Count: 0
• DNSBL Status: Listed on 2 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: None identified

## Neighborhood Analysis (148.113.128.0/24)

The /24 subnet exhibits elevated abuse characteristics:

• Abuse Density: 0.5898 (High Abuse classification)
• Total Siblings: 256
• Active Siblings: 204
• Threat Siblings: 151
• Risk Distribution: 0 High, 97 Medium, 3 Low
• Inherited Risk Score: 23

## Historical Observations

Eighteen observations recorded since initial discovery. Key temporal signals:

• Most Recent: 2026-06-17T06:50:09Z
• Threat Persistence: 0 days
• Ownership Changes: 0
• Signal Types: Listings (8 lists, 2 listed), Geo validation, Subnet analysis, Operator scoring

## Network Relationships

• Primary Network: OVH-CUST-281059693 (29 relationship entries)
• DNS Associations: proxy-ca014-san126.ahrefs.net (17 relationship entries)

## Recommended Actions

• Monitor for service activation or port opening
• Correlate RTT anomalies with potential proxying behavior
• Review DNSBL listings for context on reputation management
• Consider geo-blocking if legitimate traffic patterns don't match claimed origin

Classification: Moderate Risk - Cloud Infrastructure with Geographic Inconsistencies

---

*Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.