148.113.128.186📋 Copy

# IP Intelligence Briefing: 148.113.128.186/32

Classification: Moderate Risk (Score: 40/100)

Analysis Date: Current

Assigned Provider: OVH (ASN 16276)

Network Block: 148.113.128.0/24

Organization: Ahrefs Pte Ltd

---

## Executive Summary

IP address 148.113.128.186 is a cloud-hosted infrastructure address assigned to OVH under the OVH-CUST-281059693 customer block. The IP presents moderate risk (score 40) with no active threat indicators detected. However, the parent subnet exhibits elevated abuse density (0.5859), classifying the environment as high-abuse. The address resolves to the domain ahrefs.net with a PTR hostname of proxy-ca014-san186.ahrefs.net. No services are currently accessible on this IP.

---

## Network Classification

Geolocation: Registered to CA (ARIN), but geolocation probes indicate Singapore with significant RTT anomalies (27ms observed vs. 121.6ms minimum possible for 6082km distance).

---

## Subnet Neighborhood Analysis

Subnet: 148.113.128.0/24

Abuse Density: 0.5859 (High Abuse)

Classification: high_abuse

Inherited Risk Score: 23

Total Siblings: 256

Active Siblings: 213

Threat Siblings: 150

The parent subnet shows elevated abuse activity with 150 threat-sibling IPs out of 213 active addresses. This suggests the /24 block may be utilized for various hosting purposes with non-negligible abuse potential.

---

## Threat Indicators

No active threat indicators were identified. The IP does not appear in major threat feeds or known attacker databases.

---

## DNS and Hostname Resolution

DNS records indicate association with ahrefs.net infrastructure. Forward confirmation failed, suggesting potential DNS propagation issues or reverse DNS misconfiguration.

---

## Historical Observations

Total Observations: 21 signals recorded

Recent Activity: 2026-06-26 (multiple signal types)

Signal history indicates:

• Consistent cloud/hosting classification
• Stable network classification signals
• Multiple geolocation observations (CA and Singapore)
• No ownership changes detected
• Threat persistence: 0 days

The IP shows stable classification with no persistent malicious activity detected over the observation window.

---

## Recommended Actions

Based on the moderate risk profile and high-abuse subnet environment, the following firewall rules are recommended:

```bash

# iptables

iptables -A INPUT -s 148.113.128.186 -j DROP

# nftables

nft add rule inet filter input ip saddr 148.113.128.186 drop

# nginx

deny 148.113.128.186;

# pfSense

148.113.128.186/32

# Cloudflare WAF

{"description": "Block 148.113.128.186 — IPDebrief risk score 40", "action": "block", "filter": {"expression": "ip.src eq 148.113.128.186"}}

# AWS WAF

{"Addresses": ["148.113.128.186/32"], "Description": "IPDebrief risk 40"}

```

---

## Intelligence Notes

1. No Open Services: The IP is firewalled with no accessible services, suggesting it may be used for backend infrastructure or temporary hosting.

2. Subnet Context: The /24 subnet contains 150 threat-sibling IPs, indicating elevated abuse activity. Consider evaluating the entire 148.113.128.0/24 block if threat correlation is observed.

3. Provider Context: OVH is a major cloud hosting provider; this IP is part of their customer block (OVH-CUST-281059693). Legitimate business traffic may originate from this IP.

4. Risk Mitigation: Blocking is recommended but should be combined with traffic analysis to avoid disrupting legitimate Ahrefs infrastructure traffic. Monitor for traffic patterns during the 24-hour period following implementation.

---

Report Prepared: IPDebrief Intelligence Platform

Data Sources: IPDebrief Profile, History, Relationships, Neighborhood, Actions modules

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.