148.113.128.208📋 Copy

## IP INTELLIGENCE BRIEFING: 148.113.128.208

Date: June 18, 2026

Classification: Moderate Risk (Score: 40/100)

Executive Summary

Target IP 148.113.128.208 is hosted on OVH cloud infrastructure in Quebec, Canada. The IP resolves to ahostname in the ahrefs.net domain (proxy-ca014-san208.ahrefs.net), indicating it is a cloud-compute proxy or service endpoint. While the IP shows no direct threat indicators, it resides within a high-abuse-density subnet environment requiring defensive monitoring.

Ownership & Infrastructure

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 148.113.128.0/24
• Infrastructure Type: Cloud Compute / Hosting
• Location: Beauharnois, Quebec, Canada
• Network Role: OVH provider with cloud hosting classification

Threat Assessment

• Overall Risk Score: 40/100 (Moderate Risk)
• Abuse Confidence: No specific abuse indicators detected
• Blacklist Status: Listed on 1 of 8 DNSBL feeds
• Known Campaigns: None identified
• Tor Exit/Proxy: False
• Open Ports: None detected (firewalled/no services)
• TLS/HTTP Services: Inactive

Geographic Validation

• Country: Canada (CA)
• Region: Quebec (QC)
• GeoValidation Status: Flagged implausible (distance: 6,082km, minimum possible RTT: 121.6ms, observed: 27ms)

Neighborhood Analysis

• Subnet Abuse Density: 0.6797 (High Abuse Classification)
• Threat Siblings: 174 of 256 total IPs in /24 subnet
• Inherited Risk Score: 27/100
• Risk Distribution: 0 High, 97 Medium, 3 Low risk neighbors
• Assessment: The immediate /24 subnet exhibits elevated abuse activity, suggesting shared infrastructure risks

Observation History

• Total Observations: 24 signals recorded
• Recent Activity: Signals observed June 17-18, 2026
• Operator Score: 0.2174 (Minimal)
• Route Stability: False (route changes detected within 30 days)
• Persistence: Single threat observation; not persistently malicious

Relationship Graph

• Total Relationships: 48 identified
• Primary Network Association: OVH-CUST-281059693
• Network Type: Same Network relationships dominate the relationship graph

Recommended Actions

1. Monitor: Track activity from this IP and its subnet 148.113.128.0/24 due to high abuse density

2. DNSBL Monitoring: Investigate why the IP is listed on 1 of 8 DNSBL feeds

3. Contextual Analysis: The ahrefs.net hostname suggests legitimate cloud proxy usage, but verify against organizational threat intelligence

4. Subnet-Wide Review: Consider blocking or rate-limiting entire /24 subnet if abuse patterns align with organizational policy

5. Geolocation Discrepancy: Investigate the RTT/geolocation mismatch (6,082km distance from probe location)

Intelligence Confidence

Medium – The IP shows no direct malicious indicators but operates within a high-risk cloud hosting environment. The ahrefs.net association provides legitimate context, though the high subnet abuse density warrants defensive vigilance.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.