148.113.128.143📋 Copy

IP Intelligence Briefing: 148.113.128.143

Date: 2026-06-13

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Ownership:

- ASN: 16276 (OVH)

- Organization: Ahrefs Pte Ltd

- Network: 148.113.128.0/24

• Geolocation:

- Country: Canada (CA)

- City: Singapore (geoPlausible: False)

- Accuracy Radius: 3,000 km

• Threat Indicators:

- No malicious activity detected (no blacklists, campaigns, or known attackers).

- DNS: Resolves to `proxy-ca014-san143.ahrefs.net` (PTR record).

- Network Role: Cloud compute instance (OVH infrastructure).

---

**2. Observation History**

• Recent Activity:

- Last 30 days show stable risk profile (no significant changes).

- Geo validation failed due to RTT discrepancy (reported 26ms vs. expected 121.6ms for 6,082km distance).

• Subnet Analysis:

- 148.113.128.0/24 has high abuse density (0.5391), with 138 threat siblings and 200 active IPs.

- Inherited Risk: 21 (substantial exposure due to subnet activity).

---

**3. Network Relationships**

• Linked Entities:

- Same network: OVH-CUST-281059693 (ASN 16276).

- Domain: `ahrefs.net` (DNSSEC valid, CAA records present).

• Services:

- No open ports or TLS certificates detected.

- No HTTP server banners or HTTP/2 indicators.

---

**4. Neighborhood Analysis**

• Subnet: 148.113.128.0/24
• Risk Distribution:

- High Risk: 0 IPs

- Medium Risk: 95 IPs

- Low Risk: 5 IPs

• Abuse Density: 0 (but 138 IPs in subnet flagged as threats).
• Notable Neighbors:

- IPs with moderate risk scores (40–25) and authority scores (50).

---

**5. Recommendations**

1. Monitor Subnet: The high abuse density in the subnet (148.113.128.0/24) warrants closer scrutiny for potential lateral movement or compromised hosts.

2. Verify Geolocation: Investigate the geoPlausible discrepancy (Singapore vs. Canada) to ensure accurate threat modeling.

3. Check Domain Security: Review `ahrefs.net` for any recent security incidents or misconfigurations.

4. Network Segmentation: Consider isolating high-risk subnets to mitigate exposure from neighboring IPs.

Conclusion: While the IP itself shows no direct malicious indicators, its association with a high-risk subnet and cloud infrastructure necessitates ongoing monitoring. SOC teams should prioritize subnet-level analysis and validate geolocation data for accurate threat assessment.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.