148.113.128.232📋 Copy

IP Intelligence Briefing: 148.113.128.232/32

Executive Summary

IP 148.113.128.232 is classified as Moderate Risk (Risk Score: 40) within a high-abuse subnet environment. The address is assigned to OVH Cloud hosting infrastructure under customer organization "Dmytro, Ahrefs Pte Ltd" (ASN: 16276). No active malicious indicators were detected; the IP operates as a firewalled cloud compute node with no open ports or services.

Ownership & Infrastructure

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 148.113.128.0/24
• Infrastructure Type: CloudCompute (hosting provider)
• Network Role: Firewalled / No Services
• Service Classification: Not CDN, VPN, proxy, or Tor

Geolocation Analysis

• Reported Location: Singapore
• Validation Status: FAILED
• Discrepancy: Geolocation validation indicates a 6,082 km distance from Singapore, with minimum possible RTT of 121.6ms versus observed 27ms. This suggests either inaccurate geolocation data or potential spoofing.
• Country Attribution: CA (based on provider data)

DNS & Hostname Analysis

• PTR Hostname: proxy-ca014-san232.ahrefs.net
• Resolved Domain: ahrefs.net
• Forward Resolution: Confirmed to single hostname
• Email Authentication: No SPF or DMARC records configured

Subnet Context (148.113.128.0/24)

• Abuse Density: 0.5781 (High Abuse classification)
• Total Siblings: 256 addresses
• Active Siblings: 213
• Threat Siblings: 148
• Inherited Risk Score: 23
• Risk Distribution: All 100 sampled neighbors show Risk Score 40 (Medium)

Threat Intelligence

• Blacklist Count: 0
• Known Campaigns: None
• Threat Persistence Days: 0
• Is Known Attacker: False
• Is Tor Exit: False
• Is Spam Source: False
• Threat Persistence: Not persistently malicious

Observation History (31 total observations)

• Recent signals indicate minimal threat indicators
• Subnet abuse density signal observed (0.5781, high_abuse classification)
• No correlated threat events over the observation period

Recommended Actions for SOC

1. Monitor Contextually: While the IP itself shows no malicious indicators, the subnet exhibits elevated abuse density. Monitor for anomalous outbound traffic patterns from this /24.

2. Geolocation Verification: Investigate the geolocation discrepancy. The RTT violation suggests potential routing anomalies or data center misconfiguration.

3. Hostname Analysis: The ahrefs.net domain association warrants correlation with known SEO/traffic analytics services to determine if this is legitimate web infrastructure or compromised hosting.

4. Baseline Establishment: Establish traffic baselines for this subnet given the high-abuse classification. Any significant deviation from normal hosting traffic patterns should trigger investigation.

5. No Immediate Blocking: The IP is not currently flagged as malicious; maintain allow-listing for legitimate business traffic while monitoring for behavioral anomalies.

Final Assessment

This IP represents a cloud-hosted infrastructure node within a high-density abuse environment. The moderate risk score (40) is primarily driven by subnet-level abuse density rather than direct threat indicators. No immediate blocking required; maintain monitoring and context-aware analysis given the geolocation discrepancies and high-abuse subnet context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.