148.113.128.144📋 Copy

# IP Intelligence Briefing: 148.113.128.144/32

Classification: Moderate Risk (Score: 40/100) | Provider: OVH (ASN: 16276) | Last Updated: 2026-06-20

---

## Executive Summary

IP 148.113.128.144 is a cloud-hosted endpoint operated by Ahrefs Pte Ltd within OVH infrastructure. The IP presents moderate risk characteristics with no active service exposure and no threat indicators. Geolocation validation shows inconsistencies requiring verification. The broader /24 subnet exhibits elevated abuse density despite uniform medium-risk classification across neighbor IPs.

---

## Technical Profile

Ownership & Infrastructure:

• Organization: Ahrefs Pte Ltd
• Network Block: 148.113.128.0/24
• ASN: 16276 (OVH)
• Infrastructure Type: CloudCompute
• Hosting Classification: Yes
• Tor Exit: No | CDN: No | Proxy: No

Network Role:

• Connection Type: Firewall / No Services Detected
• Open Ports: None identified
• Server Banner: None
• TLS Certificate: None
• Service Purpose: Firewalled / No Services

Geolocation:

• Country Code: CA (Canada)
• Coordinates: 56.13°N, -106.35°W (appears inconsistent)
• RTT Validation: Violation detected (23ms < 121.6ms minimum possible for 6082km distance)
• Accuracy Radius: 3000km
• GeoSource Consensus: True | GeoPlausible: False

DNS Analysis:

• PTR Record: proxy-ca014-san144.ahrefs.net
• Forward Resolution: proxy-ca014-san144.ahrefs.net
• Domain: ahrefs.net
• SPF/DMARC: Not configured
• Forward Confirmed: No

---

## Threat Indicators

Current Status:

• Abuse Confidence Score: Not available
• Blacklist Count: 0
• DNSBL Listed: 1 of 8 checks
• Known Campaigns: None
• Threat Feeds: None
• Pulsedive Risk: Not available

Control Plane:

• Route Stability: Unstable (isRouteStable: false)
• BGP Prefix: 148.113.128.0/17
• RPKI State: Not available
• IRR Consistency: Not available
• Route Changes (30d): 0
• DNSSEC Validation: Valid
• CAA Records: Present

Campaign Analysis:

• Likelihood: None
• CERT Matches: 0
• Banner Matches: 0
• Correlated IPs: 0
• Certificate Matches: 0

---

## Observation History

Temporal Signals (Last 20 Observations):

• Observation Count: 20 signals recorded as of 2026-06-20
• Signal Confidence Range: 0.18–0.85
• Key Signal Types:

- Hosting infrastructure classification (confidence: 0.85)

- High abuse subnet classification (abuse density: 0.6875, confidence: 0.75)

- Operator score minimal (0.2174, confidence: 0.60)

- Geolocation signals with validation issues

- Overall profile confidence: 0.2377

Trend Analysis:

• Ownership Changes: 0 (stable)
• Threat Persistence Days: 0
• Threat Observation Count: 1
• Persistently Malicious: False
• No temporal escalation in threat signals

---

## Neighborhood Analysis

Subnet: 148.113.128.0/24

• Total Siblings: 256
• Active Siblings: 210
• Threat Siblings: 176
• Abuse Density: 0.6875 (high_abuse classification)
• Inherited Risk Score: 27

Neighbor Risk Distribution (100 sampled):

• High Risk: 0%
• Medium Risk: 100%
• Low Risk: 0%

Consistent Characteristics:

• All sampled neighbors (148.113.128.0 through 148.113.128.5+) show uniform riskScore: 40
• Authority scores uniformly at 50
• No high-risk outliers identified

---

## Relationship Graph

Detected Relationships: 49 total

• Primary Relationship Type: Same Network (OVH-CUST-281059693)
• Network Relationships: All 49 relationships map to OVH-CUST-281059693
• No subdomain, hostname, or organization-level relationships beyond network classification
• No certificate-based relationships identified
• No cross-IP campaign correlations

---

## Recommended Actions

SOC Analyst Guidance:

1. Monitor, Do Not Block: The IP shows no active threat indicators but maintains moderate risk classification. No firewall blocking recommended at this time.

2. Geolocation Verification: The CA country code with coordinates suggesting North American interior location presents validation inconsistency. Investigate if legitimate service or misconfiguration.

3. Subnet Context: The /24 subnet (148.113.128.0/24) shows high abuse density (0.6875) with 176 threat siblings. Monitor adjacent IPs for correlated malicious activity.

4. Ahrefs Legitimacy: IP resolves to ahrefs.net domain infrastructure. Verify against known Ahrefs service endpoints to confirm legitimacy.

5. Route Stability: Control plane indicates unstable routing. Consider monitoring for BGP anomalies or infrastructure changes.

---

## Intelligence Assessment

This IP represents a legitimate cloud-hosted endpoint within Ahrefs' operational infrastructure. The moderate risk score (40) and high abuse density classification (0.6875) reflect the

0.6875 reflect the subnet's shared hosting environment where legitimate services coexist with compromised endpoints. The uniform medium-risk classification across all sampled neighbors suggests systemic infrastructure characteristics rather than targeted malicious activity originating from this specific IP.

Final Risk Determination:

The target IP 148.113.128.144 presents low-to-moderate threat potential. Key factors supporting this assessment include:

• No Active Threat Indicators: Zero known campaigns, no blacklist matches, no service exposure detected
• Infrastructure Legitimacy: DNS records confirm association with ahrefs.net enterprise infrastructure
• Stable Ownership: No ownership changes detected, consistent organizational registration
• Controlled Environment: CloudCompute infrastructure with no open ports or accessible services

Threat Level: LOW-MODERATE (Score: 40/100)

Priority: Monitor

Recommended Actions:

1. Maintain passive monitoring on this IP and adjacent neighbors within 148.113.128.0/24

2. Alert if service exposure changes (new open ports or HTTP/HTTPS responses)

3. Investigate geolocation inconsistency if operational context suggests discrepancy

4. Correlate traffic patterns with known Ahrefs service endpoints for legitimacy confirmation

Closing: This IP warrants routine observation rather than immediate defensive action. No indicators suggest active malicious use. Update intelligence on subsequent observations or if neighborhood abuse density shifts significantly.

---

*Report generated by IPDebrief Intelligence Platform | Classification: SOC Intelligence Briefing*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.