148.113.128.156📋 Copy

IP Intelligence Briefing: 148.113.128.156

Date: June 9, 2026

---

**1. Core Profile**

• Risk Score: Moderate (50/100)
• Ownership: Registered to Ahrefs Pte Ltd (OVH ASN 16276) under CIDR 148.113.128.0/24.
• Geolocation: Confirmed as Canada (CA) with a broad accuracy radius (3000 km). City field is marked as "Singapore," which may indicate data inconsistency.
• Network Role: Cloud compute infrastructure (OVH-hosted), no public services detected.
• Threat Indicators: No malicious activity detected (no indicators, blacklists, or campaigns).

---

**2. Observation History**

• Recent Trends:

- Abused network density in the subnet 148.113.128.0/24 is 47% (mixed classification: 119 threat IPs in 253 total).

- Geolocation data shows inconsistent "Canada" and "Singapore" origins, requiring further validation.

- Operator score is Basic (0.3478), indicating a legitimate network but with potential risks.

---

**3. Relationships & DNS**

• Network Affiliation:

- Linked to OVH-CUST-281059693 (same subnet).

- DNS association with proxy-ca014-san156.ahrefs.net (Ahrefs infrastructure).

• Email & Security:

- No SPF/DKIM records detected; no email reputation data.

- DNSSEC and CAA records are present, suggesting basic security hygiene.

---

**4. Subnet Neighbors**

• Subnet: 148.113.128.0/24 (253 IPs total).
• Risk Distribution:

- High risk: 0 IPs.

- Medium risk: 70 IPs (40–60 risk score).

- Low risk: 30 IPs (25–40 risk score).

• Notable Neighbors:

- IPs with risk scores ≥40 are flagged, suggesting potential compromised systems in the subnet.

---

**5. Actionable Insights**

• Monitor Subnet: The 148.113.128.0/24 subnet has a 47% abuse density, warranting closer scrutiny for lateral movement or command-and-control (C2) activity.
• Verify Geolocation: Discrepancies in geolocation data (Canada vs. Singapore) may indicate misconfiguration or spoofing.
• Block High-Risk Neighbors: Consider blocking neighboring IPs with ≥40 risk scores to mitigate potential threats.
• Check DNS Behavior: Monitor traffic to proxy-ca014-san156.ahrefs.net for unusual patterns, as it is linked to this IP.

---

**Conclusion**

The IP 148.113.128.156 is part of a legitimate cloud infrastructure managed by OVH for Ahrefs. While no direct malicious activity is detected, the associated subnet has a significant risk profile. SOC teams should prioritize monitoring the subnet for suspicious behavior and validate geolocation inconsistencies.

Recommended Next Steps:

1. Correlate subnet neighbor risks with internal logs.

2. Validate geolocation data with additional sources.

3. Implement firewall rules to restrict traffic to high-risk neighbors.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.