148.113.128.187📋 Copy

# IP Intelligence Briefing: 148.113.128.187/32

Date: 2026-06-19

Classification: Moderate Risk / Cloud Infrastructure

Prepared for: SOC Operations

---

## EXECUTIVE SUMMARY

IP 148.113.128.187 is a cloud-based infrastructure endpoint associated with OVH hosting services. The address operates under the Ahrefs organization and presents a moderate risk profile (score: 40). While no active malicious indicators were detected, the subnet exhibits elevated abuse density (0.5586) with significant threat sibling activity. Geographic validation anomalies indicate potential proxy or routing irregularities.

---

## OWNERSHIP & INFRASTRUCTURE

Key Finding: The IP is associated with Ahrefs, a legitimate SEO analytics platform. However, the geolocation validation shows a 6082km discrepancy between reported Singapore location and consensus Canada positioning, indicating potential routing anomalies or proxy usage.

---

## THREAT ASSESSMENT

Risk Profile

• Overall Risk Score: 40/100 (Moderate Risk)
• Abuse Confidence Score: Not calculated (null)
• Threat Indicators: None detected
• Blacklist Status: Clean (0 blacklists)
• Campaign Association: None identified

Network Context

• Subnet Classification: High Abuse (148.113.128.0/24)
• Abuse Density: 0.5586 (55.86%)
• Threat Siblings: 143 out of 256 total IPs in subnet
• Active Siblings: 204 endpoints currently active

Assessment: The parent subnet demonstrates significant abuse activity, though this specific IP lacks direct malicious indicators.

---

## OBSERVATION HISTORY

Total Observations: 23 signals collected

Temporal Activity:

• Most Recent: 2026-06-19T22:34:59 UTC
• Previous Activity: 2026-06-14T22:44:44 UTC
• Threat Persistence: 0 days (no persistent malicious activity)
• Ownership Changes: 0 (stable ownership)

Signal Breakdown:

• Operator Score: 0.2174 (Minimal)
• DNSSEC Valid: Confirmed
• CAA Records: Present
• RTT Validation: Violation detected (27ms < 121.6ms minimum for 6082km distance)

---

## TECHNICAL INDICATORS

DNS Analysis

Services & Ports

• Open Ports: None detected
• TLS Certificate: Not available
• HTTP Title: Not detected
• Connection Type: Firewall protected / No services exposed

Control Plane

• BGP Prefix: 148.113.128.0/17
• Route Stability: Unstable (isRouteStable: false)
• Route Changes (30d): 0
• MoAS Status: False

---

## RELATIONSHIP MAPPING

Direct Relationships: 51 total relationships identified

• Primary Association: OVH-CUST-281059693 network (46+ duplicate references)
• Network Classification: Same Network relationships

---

## RECOMMENDED ACTIONS

Based on the moderate risk profile and subnet abuse characteristics, the following security measures are recommended:

Immediate Actions

1. Monitor - Continue monitoring for behavioral changes; no immediate blocking required

2. Verify Legitimacy - Confirm endpoint is associated with authorized Ahrefs operations

3. Geo-validation - Investigate geolocation discrepancy (Singapore vs. Canada)

Firewall Rules (if applicable)

```bash

# No direct blocking recommended - monitor only

# If blocking required, target subnet-level patterns:

iptables -A INPUT -s 148.113.128.0/24 -j LOG --log-prefix "OVH-MONITOR: "

```

Threat Hunting Indicators

• DNS Anomalies: Verify proxy-ca014-san187.ahrefs.net resolution patterns
• RTT Anomalies: Investigate geographic routing inconsistencies
• Subnet Context: Monitor for lateral movement patterns from the 143 threat siblings

---

## CONCLUSION

IP 148.113.128.187 represents cloud infrastructure with moderate risk characteristics. The absence of active threat indicators, combined with legitimate Ahrefs domain associations, suggests this is a legitimate endpoint operating within a high-density abuse subnet. The geographic validation violation warrants periodic review but does not indicate malicious activity. Continue monitoring and correlate with any observed network behavior anomalies.

Status: Monitor (No immediate action required)

Confidence Level: High (23 historical observations, stable ownership)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.