148.113.128.13📋 Copy

# IP Intelligence Briefing: 148.113.128.13

## Executive Summary

Risk Level: Moderate (40/100)

Classification: Cloud Infrastructure / Hosting Provider

Primary Concern: Geolocation Discrepancies, High-Abuse Neighborhood, DNSBL Listings

---

## Ownership & Network Context

• Provider: OVH Cloud (ASN 16276)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 148.113.128.0/24
• Infrastructure Type: Cloud Compute / Hosting
• PTR Hostname: proxy-ca014-san13.ahrefs.net (resolves to ahrefs.net)

## Risk Indicators

• Abuse Confidence: Elevated neighborhood context (0.5898 abuse density)
• DNSBL Listings: 1 of 8 major blacklists
• Operator Score: 0.087 (Minimal operator risk)
• Geolocation Validity: FLAGGED — Reports Singapore city with CA country code (6,082 km discrepancy, RTT validation failed at 28ms vs expected 121.6ms)

## Neighborhood Assessment

• Subnet: 148.113.128.0/24
• Active Siblings: 217 of 256 IPs active
• Threat Siblings: 151 IPs flagged as threats
• Risk Distribution: 100 medium-risk neighbors (0 high, 0 low)
• Inherited Risk Score: 23

## Historical Observations

• Total Signals: 24 observations tracked
• Threat Persistence: 0 days (no persistent malicious activity detected)
• Recent Signals: Minimal operator risk (0.087), DNS ownership confirmed (ahrefs.net)
• Service State: Firewalled / No open ports detected

## Relationship Graph

• 62 Relationships identified (primarily same-network associations)
• Primary Target: OVH-CUST-281059693 network block

---

## Threat Intelligence Assessment

This IP operates as part of OVH cloud infrastructure associated with Ahrefs, a known SEO analytics platform. The hostname mapping (proxy-ca014-san13.ahrefs.net) suggests infrastructure supporting web services rather than direct attacker infrastructure. However, the geolocation validation failure (Singapore/Singapore city with CA country code, impossible RTT distance) indicates either data corruption or potential spoofing.

The high-abuse neighborhood (151/256 threat siblings) is significant context for threat intelligence correlation. While this specific IP shows no persistent malicious behavior, proximity to compromised neighbors increases false-positive risk during threat hunting.

---

## Recommended Actions for SOC

1. Monitor for Anomalous Traffic — Flag connections from this IP during threat hunting operations

2. Correlate with Known Ahrefs Infrastructure — Verify if this is legitimate marketing/SEO infrastructure

3. Watch for Geolocation Spoofing — Investigate any traffic claiming origin from this IP range if source/destination mismatches occur

4. Apply Standard Cloud Infrastructure Rules — No immediate blocking required; treat as monitored infrastructure

5. Track Neighborhood Activity — Monitor other IPs in 148.113.128.0/24 for emerging threats

---

## Confidence Level

Medium-High — Multiple validation sources (DNS, ASN, provider data) confirm infrastructure nature. Primary uncertainty: geolocation accuracy.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.