148.113.128.226📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 148.113.128.226/32

Classification: MODERATE RISK / HOSTING INFRASTRUCTURE

Report Date: 2026-06-28

---

## EXECUTIVE SUMMARY

IP 148.113.128.226 is a cloud-hosted infrastructure address operated by OVH (ASN 16276) under customer allocation OVH-CUST-281059693. The address resolves to the Ahrefs.net domain (proxy-ca014-san226.ahrefs.net) and exhibits moderate risk characteristics (score: 40/100). While the IP itself shows no direct threat indicators, it resides within a high-abuse density subnet (0.6953) with significant correlated malicious activity from neighboring addresses.

---

## RISK ASSESSMENT

Threat Classification: None detected. IP not flagged as known attacker, spam source, or Tor exit node.

---

## NETWORK ATTRIBUTES

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 148.113.128.0/24
• Infrastructure Type: CloudCompute / Hosting
• Geolocation: CA (reported), Singapore (coordinates) — INVALID
• DNS PTR: proxy-ca014-san226.ahrefs.net
• Forward Resolution: ahrefs.net
• Services: None detected (firewalled/no services)

Geolocation Validation: Invalid. RTT measurements (27ms) contradict geographic distance (6082km). Minimum possible RTT should be 121.6ms for this distance.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 148.113.128.0/24

• Abuse Density: 0.6953 (HIGH ABUSE)
• Classification: high_abuse
• Total Siblings: 256
• Active Siblings: 210
• Threat Siblings: 178

Risk Distribution:

• High Risk: 0
• Medium Risk: 100
• Low Risk: 0

The subnet exhibits significant abuse activity. While this IP shows no direct malicious indicators, the high-abuse neighborhood context warrants contextual awareness.

---

## OBSERVATION HISTORY

Total Observations: 23

Recent Classifications:

• 2026-06-28: Cloud hosting infrastructure (OVH), no proxy/VPN/Tor
• 2026-06-20: Cloud/hosting classification maintained; high_abuse subnet classification; operator score 0.2174 (Minimal)

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: False

---

## RELATIONSHIP MAPPING

Total Relationships: 60

• Network Relationships: 55+ (OVH-CUST-281059693)
• External Entities: None identified

The IP demonstrates strong network-level affiliation with OVH hosting infrastructure but lacks ties to external malicious campaigns or related threat actors.

---

## RECOMMENDATIONS

Defense Posture:

1. Monitor Contextually: Track activity from this IP within the high-abuse subnet context.

2. No Immediate Action Required: IP shows no direct threat indicators.

3. Geolocation Validation Required: Source data contains invalid geolocation markers.

Firewall/Access Control:

• No specific blocking rules recommended (no threat indicators).
• Consider monitoring for unusual connection patterns given neighborhood abuse density.

Investigation Priority: LOW-MEDIUM

• Low priority: No direct malicious activity detected.
• Medium priority: Subnet abuse density suggests potential for correlated threats.

---

End of Briefing

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.