148.113.128.203📋 Copy

# INTELLIGENCE BRIEFING: 148.113.128.203/32

Classification: Moderate Risk

Date: 2026-06-22

Prepared By: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

Target IP 148.113.128.203 is a cloud infrastructure address registered to OVH hosting provider, associated with Ahrefs.net domain. The IP resides in a subnet exhibiting high abuse density (0.6602) with 66% of active sibling IPs flagged as threats. Despite moderate individual risk scoring, network context suggests elevated threat probability.

---

## OWNERSHIP & GEOGRAPHY

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• Network: OVH-CUST-281059693
• Country/Region: Quebec, Canada (CA/QC)
• City: Beauharnois
• Infrastructure: CloudCompute/Hosting environment

NOTE: Geolocation data flagged as implausible. RTT measurements (27ms) inconsistent with claimed 6,082km distance, indicating potential data center misreporting or spoofing.

---

## NETWORK ROLE

• Classification: Cloud Infrastructure
• Status: Firewalled / No Services Detected
• PTR Hostname: proxy-ca014-san203.ahrefs.net
• Forward Resolution: Confirmed (1 hostname)
• Open Ports: None detected
• TLS/HTTP: No services exposed

---

## THREAT INDICATORS

• Risk Score: 40 (Moderate)
• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: False
• Spam Source: False
• Known Attacker: False

Control Plane: Listed on 1 of 8 DNSBLs. Route stability flag indicates dynamic routing behavior. DNSSEC validation present.

---

## NEIGHBORHOOD ANALYSIS (148.113.128.0/24)

• Abuse Density: 0.6602 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 213 (83%)
• Threat Siblings: 169 (79% of active IPs)
• Inherited Risk Score: 26

Context: This subnet demonstrates significant malicious activity concentration. 169 of 213 active neighbors exhibit threat indicators, suggesting the target IP may be co-located with or sharing infrastructure with known malicious endpoints.

---

## OBSERVATION HISTORY

22 observations recorded. Key signals from 2026-06-22:

• Cloud hosting infrastructure confirmed (OVH provider)
• Subnet abuse density classification: high_abuse
• Operator score: Minimal (0.2174)
• DNS CAA records: Valid

No historical threat escalation detected. Single threat observation recorded.

---

## RELATIONSHIP MAPPING

57 relationships identified:

• Primary: Same Network (OVH-CUST-281059693)
• Associated Domain: ahrefs.net
• No Certificate Relationships Detected
• No Correlated Campaigns

---

## RECOMMENDED ACTIONS

SOC Analyst Recommendations:

1. Monitor - Do not block. IP shows moderate risk with no active threat indicators.

2. Correlate - Investigate related IPs in 148.113.128.0/24 subnet given 79% threat sibling rate.

3. Verify - Confirm legitimate business use case for ahrefs.net proxy hostname.

4. Monitor DNS - Watch for changes in forward resolution or hostname associations.

5. Network Context - Consider subnet-level filtering if threat indicators emerge.

Firewall Rule: No immediate blocking recommended. Monitor for outbound connection patterns from this IP.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.