148.113.128.221
# IP Intelligence Briefing: 148.113.128.221/32
## Executive Summary
IP address 148.113.128.221 is classified as Moderate Risk (risk score: 40). The IP belongs to OVH (ASN 16276), operating under customer block OVH-CUST-281059693 for organization "Dmytro, Ahrefs Pte Ltd." While the IP itself shows no active threat indicators, it resides within a subnet exhibiting elevated abuse density (71.48%), suggesting contextual risk.
---
## Ownership and Network Context
| Field | Value |
|---|---|
| **ASN** | 16276 (OVH) |
| **Organization** | Dmytro, Ahrefs Pte Ltd |
| **Netname** | OVH-CUST-281059693 |
| **CIDR Block** | 148.113.128.0/24 |
| **Infrastructure Type** | Cloud Compute (Hosting) |
| **Service Purpose** | Firewalled / No Services |
---
## Geolocation Analysis
- Reported Country: CA (Canada)
- Geolocation Consensus: Singapore
- GeoPlausible Validation: False
- Geolocation Accuracy: 3000 km radius
- Coordinates: 56.13°N, -106.35°W (inferred from geolocation provider)
Note: Geolocation data shows inconsistency between reported country (CA) and geolocation consensus (Singapore). This may indicate geolocation spoofing or misattribution.
---
## DNS Resolution
| Parameter | Value |
|---|---|
| **PTR Hostname** | proxy-ca014-san221.ahrefs.net |
| **Domain** | ahrefs.net |
| **Forward Resolution** | proxy-ca014-san221.ahrefs.net |
| **Forward Confirmed** | False |
The PTR record resolves to an Ahrefs infrastructure hostname, but forward DNS confirmation failed, indicating potential DNS misconfiguration or proxy usage.
---
## Threat Assessment
| Indicator | Status |
|---|---|
| **Known Attacker** | No |
| **Tor Exit Node** | No |
| **Spam Source** | No |
| **Blacklist Count** | 0 |
| **DNSBL Listed** | 1 of 8 lists |
| **Active Threat Indicators** | None |
| **Associated Campaigns** | None |
---
## Neighborhood Analysis (148.113.128.0/24)
| Metric | Value |
|---|---|
| **Subnet Abuse Density** | 0.7148 (High) |
| **Classification** | high_abuse |
| **Total Subnet IPs** | 256 |
| **Active Siblings** | 210 |
| **Threat Siblings** | 183 |
| **Inherited Risk** | 28 |
Risk Distribution: 100% medium-risk, 0% high/low risk neighbors.
---
## Historical Observations
18 observations recorded with the following key signals:
- Subnet abuse density consistently observed at 0.7148
- DNS resolution to ahrefs.net confirmed
- No persistent malicious activity detected
- Route stability flagged as false
---
## Control Plane Data
- Origin ASN: 16276
- BGP Prefix: 148.113.128.0/17
- Route Stability: False
- DNSSEC Valid: True
- CAA Records: Present
---
## Recommended Actions
No specific security actions or firewall rules are recommended at this time. The IP shows:
- No active service exposure (no open ports detected)
- No threat indicators
- No blacklist presence
However, the elevated neighborhood abuse density warrants contextual awareness.
---
## SOC Analyst Notes
1. Monitor: Track changes in geolocation attribution (CA vs Singapore discrepancy)
2. Context: 71% of the /24 subnet shows abuse density; monitor for lateral threat indicators
3. Forward DNS: Failed forward confirmation on PTR record may indicate proxy behavior
4. Risk Level: Moderate (40) with contextual elevation from subnet environment
Classification: Moderate Risk – Cloud Hosting Infrastructure with Elevated Neighborhood Risk
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Dmytro, Ahrefs Pte Ltd |
| ASN | AS16276 |
| Network Name | OVH-CUST-281059693 |
| CIDR Block | 148.113.128.0/24 |
| RIR | ARIN |
| Country | Singapore |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | proxy-ca014-san221.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-ca014-san221.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 27% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 19% | 2 | 2 |
| ownership | 19% | 2 | 2 |
| reputation | 22% | 1 | 3 |
| geolocation | 15% | 2 | 2 |
| Overall | 19% | 10 | 14 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-29 12:04:14 UTC |
| Last Seen | 2026-06-29 06:21:07 UTC |
| Profile Built | 2026-06-29 06:27:25 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 21 |
Full dossier details are available via our API.