148.113.128.34📋 Copy

IP Intelligence Briefing: 148.113.128.34

*Generated using IPDebrief tools*

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Owner: Dmytro, Ahrefs Pte Ltd (OVH, ASN 16276)
• Geolocation:

- Country: Canada (CA)

- City: Singapore

- Geo Validation: RTT anomaly detected (27ms vs. expected 121.6ms for 6,082km distance).

• Network Role:

- Type: Cloud Compute (OVH infrastructure)

- Services: No open ports, no TLS certs, no HTTP services.

• Threat Indicators:

- No direct malware, phishing, or exploit activity detected.

- Subnet abuse density: High (0.5391).

---

**2. Observation History**

• Recent Activity:

- Flagged for high abuse in its /24 subnet (148.113.128.0/24).

- Geo validation inconsistencies (RTT mismatch).

- No persistent malicious behavior (threat persistence days: 0).

• Trend: Risk score stable at 40; no upward trend in threats.

---

**3. Network Relationships**

• Linked Entities:

- Subnet: 148.113.128.0/24 (OVH-CUST-281059693).

- Domain: `ahrefs.net` (PTR hostname: `proxy-ca014-san34.ahrefs.net`).

• No Direct Threat Links: No connections to known malicious organizations, campaigns, or C2 servers.

---

**4. Neighborhood Analysis**

• Subnet: 148.113.128.0/24 (256 IPs).
• Risk Distribution:

- High Risk: 0 IPs

- Medium Risk: 95 IPs

- Low Risk: 5 IPs

• Abuse Density: 53.91% of neighbors show abuse indicators.
• Notable Neighbors:

- 148.113.128.0 (risk score 40)

- 148.113.128.1 (risk score 25)

- 148.113.128.2 (risk score 40)

---

**5. Actionable Insights**

• SOC Recommendations:

- Block/monitor: Consider blocking this IP if it’s not a legitimate service, given the subnet’s high abuse density.

- Subnet Monitoring: Investigate the 148.113.128.0/24 subnet for potential lateral movement or compromised hosts.

- Geolocation Verification: Validate the IP’s location anomalies (RTT mismatch) to rule out spoofing or misconfigured cloud instances.

- Cloud Provider Check: Confirm with OVH if this IP is part of a legitimate cloud compute instance or if there are security alerts for the subnet.

---

Final Note: This IP is associated with a cloud provider (OVH) and shows no direct malicious activity. However, its subnet has a high abuse density, warranting further investigation into potential network compromise or misconfigured services.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.