148.113.128.27📋 Copy

# IP INTELLIGENCE BRIEFING: 148.113.128.27

Classification: Moderate Risk | Risk Score: 40/100

## EXECUTIVE SUMMARY

IP address 148.113.128.27 is a cloud hosting endpoint associated with OVH infrastructure (ASN 16276) under customer assignment OVH-CUST-281059693. The IP resolves to a domain affiliated with ahrefs.net (proxy-ca014-san27.ahrefs.net). While the IP itself shows moderate risk characteristics, the assigned /24 subnet demonstrates elevated abuse density (0.6133) with 157 threat-sibling IPs out of 205 active neighbors.

## OWNERSHIP & NETWORK ATTRIBUTES

## DNS & IDENTIFYING CHARACTERISTICS

• PTR Record: proxy-ca014-san27.ahrefs.net
• Forward Resolution: proxy-ca014-san27.ahrefs.net (1 record)
• Forward Confirmation: Failed
• Email Authentication: SPF/DMARC records absent
• CAA Records: Present
• DNSSEC: Valid

## THREAT INTELLIGENCE INDICATORS

• Risk Score: 40 (Moderate Risk)
• Blacklist Status: Listed on 1 of 8 DNSBL feeds
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Active Threat Campaigns: None identified
• Control Plane: Route unstable (0 route changes in 30d, isRouteStable=false)
• Operator Score: 0.2174 (Minimal)

## NEIGHBORHOOD ANALYSIS (148.113.128.0/24)

• Total Subnet Siblings: 256
• Active Siblings: 205
• Threat Siblings: 157
• Abuse Density: 0.6133 (High Abuse Classification)
• Inherited Risk: 24
• Risk Distribution: 100 medium-risk neighbors, 0 high-risk

The /24 subnet exhibits significant abuse density, indicating this IP shares infrastructure with multiple potentially compromised endpoints.

## OBSERVATION HISTORY

Recent signal observations (2026-06-20) captured:

• DNS listings with 8 total blacklist entries (2 listed), maximum severity: high
• Subnet classification confirmed: high_abuse (abuse_density: 0.6133, threat_siblings: 157)
• Operator assessment: minimal (raw_score: 0.25)
• Overall data confidence: 20.27% (6/6 dimensions covered)

## SECURITY ACTIONS & RECOMMENDATIONS

Recommended Blocking Rules:

## ANALYST NOTES

This IP demonstrates moderate-risk characteristics primarily driven by subnet-level abuse density rather than direct threat indicators. The ahrefs.net association suggests potential legitimate use, but the high-abuse neighborhood classification warrants defensive blocking if this IP appears in threat feeds or correlates with malicious activity. The lack of open ports and services reduces immediate exploitation risk, though the cloud hosting infrastructure enables potential abuse scenarios. Recommend monitoring for changes in DNS reputation or emergence of new threat indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.