148.113.128.164📋 Copy

# IP Intelligence Briefing: 148.113.128.164/32

Classification: Moderate Risk | Analysis Date: Current | Prepared For: SOC Operations

## Executive Summary

IP address 148.113.128.164 was identified as a moderate-risk infrastructure endpoint operating within a high-abuse residential cloud subnet. The IP belongs to OVH's cloud hosting infrastructure and is associated with Ahrefs Pte Ltd organizational registration. Significant geolocation inconsistencies were detected during probing operations.

## Infrastructure Profile

Ownership & Classification:

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 148.113.128.0/24
• Infrastructure Type: CloudCompute / Hosting
• Provider: OVH

DNS Resolution:

• PTR Hostname: proxy-ca014-san164.ahrefs.net
• Forward Resolution: proxy-ca014-san164.ahrefs.net (1 record)
• Forward Confirmed: No
• Email Authentication: SPF/DMARC not configured

Network Services:

• Open Ports: None detected
• Service Status: Firewalled / No Services
• TLS Certificate: Not present
• HTTP Banner: No data collected

## Threat Assessment

Risk Score: 40 (Moderate Risk)

• Provider Score: 0
• Authority Score: 0
• Stability Score: 0

Threat Indicators:

• Blacklist Count: 0
• Known Campaigns: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Listings: 1 of 8 total lists

Control Plane Analysis:

• BGP Prefix: 148.113.128.0/17
• Route Stability: Unstable
• MoAS Status: No
• RPKI State: Not verified
• IRR Consistency: Not verified

## Neighborhood Analysis

The IP resides within subnet 148.113.128.0/24, classified as high-abuse density:

• Subnet Abuse Density: 0.582
• Classification: High Abuse
• Total Subnet Siblings: 256
• Active Siblings: 213
• Threat Siblings: 149
• Inherited Risk Score: 23

Analysis of neighboring IPs (sample of 100) showed uniform risk distribution of 100 medium-risk endpoints with no high-risk classifications in the sample set.

## Geolocation Anomalies

Critical geolocation inconsistencies were detected:

• Reported Country: CA (Canada)
• Detected Location: Singapore
• Distance Discrepancy: 6,082 km
• Measured RTT: 27ms
• Minimum Possible RTT: 121.6ms

The measured RTT is physically impossible for the reported distance, indicating geolocation data spoofing or database inconsistency. This violation suggests potential data manipulation or misattribution.

## Historical Observations

The IP generated 21 signal observations over the observation period. Recent telemetry includes:

• Network classification signals (June 2026)
• Abuse density metrics: 0.582 (High Abuse)
• Cloud infrastructure confirmation: OVH hosting environment
• CAA DNS record validation: Confirmed

Observations indicate persistent cloud infrastructure operation with no significant threat profile evolution.

## Relationship Network

The IP maintains 62 recorded relationships, predominantly classified as "Same Network" connections to OVH-CUST-281059693. No organizational or certificate-based relationships were identified beyond network infrastructure associations.

## Recommended Security Actions

Based on risk profile analysis, the following defensive measures are recommended:

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 148.113.128.164 -j DROP

# nftables

nft add rule inet filter input ip saddr 148.113.128.164 drop

# Nginx

deny 148.113.128.164;

```

Web Application Firewall:

• Cloudflare WAF: Block IP 148.113.128.164 — Risk score 40
• AWS WAF: Block address 148.113.128.164/32

## Operational Notes

This IP is part of OVH's cloud hosting infrastructure serving Ahrefs-related services. The moderate risk classification stems from subnet-level abuse density rather than direct threat indicators. The geolocation anomaly (impossible RTT-distance relationship) warrants investigation if this IP appears in threat telemetry.

Priority: Monitor | Action: Block at perimeter firewall

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.