148.113.128.139📋 Copy

# IP Intelligence Briefing: 148.113.128.139/32

## Executive Summary

IP 148.113.128.139 is a low-risk infrastructure address associated with Ahrefs (OVH-CUST-281059693), a legitimate SEO analytics provider. The IP exhibits no active threat indicators, no open services, and maintains a risk score of 15. Operational context indicates this is a firewalled cloud compute resource.

## Technical Profile

• Risk Score: 15 (Low Risk)
• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network: OVH-CUST-281059693
• Classification: CloudCompute, Hosting infrastructure
• Geolocation: Singapore (with CA registration metadata)
• DNS: proxy-ca014-san139.ahrefs.net (Ahrefs domain)

## Threat Assessment

No malicious indicators detected across all threat feeds:

• Blacklist Count: 0
• Threat Indicators: None
• Known Campaigns: None
• Tor Exit: False
• Known Attacker: False
• Spam Source: False
• DNSBL Listed: 1 of 8 lists

Services are not accessible (firewalled/no services detected). No TLS certificates or HTTP services observed.

## Network Context

Subnet Analysis (148.113.128.0/24):

• Abuse Density: 0.4704 (Mixed classification)
• Total Siblings: 253
• Active Siblings: 196
• Threat Siblings: 119
• Inherited Risk: 18

The subnet shows elevated activity density with 119 threat-identified siblings, but this IP remains clean. Neighbor analysis shows risk distribution skewed toward medium (97) and low (3) risk IPs, with no high-risk neighbors detected.

## Historical Observations

• Observation Count: 23
• Recent Activity: Consistent routing and operator signals observed through June 2026
• Operator Score: 0.5217 (Moderate)
• Threat Persistence: 0 days
• Ownership Changes: 0
• Status: Not persistently malicious

Control plane shows valid RPKI state, DNSSEC validation enabled, and IRR consistency matched.

## Relationship Graph

27 relationships identified:

• Network Associations: Multiple mappings to OVH-CUST-281059693
• DNS Associations: All resolve to proxy-ca014-san139.ahrefs.net
• Threat Associations: None detected

## Recommended Actions

Allow with monitoring. This IP represents legitimate infrastructure for Ahrefs, a well-established web analytics platform. No firewall blocking required. If traffic is observed, verify against expected Ahrefs service patterns.

SOC Analyst Notes: The IP's hostname format (proxy-ca014-san139.ahrefs.net) and organizational ownership confirm this is production infrastructure for Ahrefs. The subnet's mixed classification reflects shared hosting infrastructure common in cloud environments. No defensive action required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.