148.113.128.16📋 Copy

# IP Intelligence Briefing: 148.113.128.16/32

Date: Current Analysis

Classification: Moderate Risk - Cloud Infrastructure with High-Abuse Neighborhood

Primary Provider: OVH Cloud

## Executive Summary

IP 148.113.128.16 is a cloud-hosted infrastructure address assigned to Ahrefs Pte Ltd (ASN 16276, OVH) operating from the 148.113.128.0/24 subnet. The IP carries a risk score of 40 (Moderate Risk) and is associated with a high-abuse subnet environment. No active threat indicators were observed on this specific address, though the subnet exhibits elevated abuse density (0.6953).

## Infrastructure Profile

Ownership & Provider:

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• CIDR: 148.113.128.0/24
• Infrastructure Type: Cloud Computing / Hosting
• Registration: ARIN (no specific registration date)

Geolocation:

• Reported Location: Singapore (CA region)
• Geolocation Validation: Flagged as implausible (distance: 6,082km; minimum possible RTT: 121.6ms; observed RTT: 27ms)
• Accuracy Radius: 3,000km

DNS & Resolution:

• PTR Hostname: proxy-ca014-san16.ahrefs.net
• Forward Resolution: ahrefs.net (1 hostname)
• Email Authentication: SPF/DMARC not configured
• Certificate Authority Records: Present (CAA)

Service Status:

• Open Ports: None detected
• Network Role: Firewalled / No Services
• Classification: Cloud Hosting (not CDN, VPN, or proxy)

## Threat Assessment

Current Threat Indicators:

• Blacklist Listings: 1 of 8 DNSBLs (listed)
• Abuse Confidence Score: Not scored
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Historical Observations (23 total):

• Multiple blacklist listings detected with high-severity ratings
• DNS resolution activity for ahrefs.net observed
• Subnet-level abuse density signals (0.6953) recorded

## Neighborhood Analysis

Subnet: 148.113.128.0/24

• Abuse Density: 0.6953 (High)
• Classification: High Abuse
• Total Subnet Capacity: 256 IPs
• Active Siblings: 210
• Threat-Associated Siblings: 178
• Inherited Risk Score: 27

The subnet demonstrates significant abuse presence with 69.5% abuse density. This environment hosts 178 threat-associated IPs within 256 total addresses, indicating concentrated malicious activity patterns.

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 100
• Low Risk: 0

## Network Intelligence

Relationship Graph:

• 46 total relationships identified
• Primary associations: Same Network (OVH-CUST-281059693)
• Control Plane: Origin ASN 16276, BGP Prefix 148.113.128.0/17
• Route Stability: Unstable
• RPKI State: Not evaluated
• DNSSEC: Valid

## Recommended Actions

Based on risk profile and neighborhood context, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 148.113.128.16 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 148.113.128.16 drop

```

nginx:

```

deny 148.113.128.16;

```

pfSense:

```

148.113.128.16/32

```

Cloudflare WAF:

```json

{

"description": "Block 148.113.128.16 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 148.113.128.16"

}

}

```

AWS WAF:

```json

{

"Addresses": ["148.113.128.16/32"],

"Description": "IPDebrief risk 40"

}

```

## Analysis Notes

1. Subnet Context: The 148.113.128.0/24 subnet demonstrates high-abuse characteristics with 178 threat-associated IPs. This environment warrants proactive monitoring of all subnet addresses.

2. Geolocation Anomaly: Reported Singapore location contradicts RTT measurements suggesting North American origin. This discrepancy may indicate misconfigured geolocation data or proxy usage.

3. Ahrefs Association: The IP resolves to ahrefs.net infrastructure. Legitimate Ahrefs services should be identified and whitelisted separately from this high-abuse subnet context.

4. Service State: No open ports detected, indicating the IP may be dormant, misconfigured, or intentionally firewalled.

5. Blacklist Presence: Listed on at least one DNSBL with high-severity rating. Additional verification recommended before blocking.

---

Status: Monitor/Block based on organizational threat tolerance

Last Updated: Current Analysis

Analyst Notes: Correlate with known Ahrefs legitimate services. Consider subnet-wide monitoring due to high abuse density.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.