148.113.128.61

{ } JSON 🔧 Full Actions API

🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

## INTELLIGENCE BRIEFING: IP 148.113.128.61/32

Classification: Moderate Risk – Cloud Infrastructure Host

---

EXECUTIVE SUMMARY

IP address 148.113.128.61 is assigned to Ahrefs Pte Ltd (OVH-CUST-281059693) and operates within OVH's cloud compute infrastructure. The IP resolves to proxy-ca014-san61.ahrefs.net and presents moderate risk (score: 40) with no direct threat indicators detected. Geolocation inconsistencies and subnet-level abuse characteristics warrant monitoring.

---

OWNERSHIP & INFRASTRUCTURE

Organization: Ahrefs Pte Ltd (Dmytro, Ahrefs Pte Ltd)
ASN: 16276 (OVH SAS)
Network Block: 148.113.128.0/24
Infrastructure Type: Cloud Compute (OVH hosting)
Connection Status: Firewalled / No Services Detected

---

GEOLOCATION VALIDATION

Claimed Location: Singapore (CA)
Validation Status: INCONSISTENT
Geolocation Consensus: Failed (2 sources disagree)
RTT Violation: Observed RTT of 25ms violates minimum expected 121.6ms for 6,082km distance
Probe Count: 5 probes conducted
Assessment: Geolocation data unreliable; IP likely hosted in North American region

---

DNS & IDENTIFICATION

PTR Hostname: proxy-ca014-san61.ahrefs.net
Resolved Domain: ahrefs.net
Forward Resolution: Confirmed (1 hostname)
Email Authentication: SPF and DMARC records not detected
HTTPS/TLS: No TLS certificates detected
HTTP Services: No open ports or HTTP titles detected

---

THREAT INDICATORS

Threat Indicators: None detected
Known Attacker: False
Spam Source: False
Tor Exit Node: False
Blacklist Count: 0
Known Campaigns: None
Threat Observation Count: 1
DNSBL Listings: 1 of 8 total lists

---

OBSERVATION HISTORY (21 TOTAL)

Recent signal observations indicate:

June 2026: DNS activity for ahrefs.net with CAA records present
June 2026: Geolocation anomalies with RTT violations persisting
Subnet Classification: Consistently marked as high abuse
Operator Score: 0.2174 (Minimal)

---

THREAT ASSESSMENT

The IP operates as part of Ahrefs' cloud infrastructure with standard proxy designation. No direct malicious activity was observed. However, the following risk factors apply:

1. High-abuse subnet context (166 threat-sibling IPs in /24)

2. Geolocation inconsistencies suggesting potential misconfiguration or spoofing

3. Cloud hosting environment commonly used for legitimate and opportunistic activities

4. Lack of email authentication (SPF/DMARC) for associated domain

---

RECOMMENDED ACTIONS

Monitoring: Add to baseline traffic monitoring for subnet anomalies
Geolocation: Flag geolocation discrepancies for further validation
DNSBL: Investigate 1 DNSBL listing source
Network Policy: Standard cloud infrastructure monitoring applies
Blocking: Not recommended without additional correlation

---

Generated: [Current Date]

Status: Active Monitoring Recommended

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

Country	🇨🇦 Canada
Region	—
City	Singapore
Timezone	—
Latitude	43.63
Longitude	-79.37

🏢 Ownership & Registration

Organization	Dmytro, Ahrefs Pte Ltd
ASN	AS16276
Network Name	OVH-CUST-281059693
CIDR Block	148.113.128.0/24
RIR	ARIN
Country	Singapore
Abuse Contact	—

🌐 DNS Intelligence

PTR	proxy-ca014-san61.ahrefs.net
Forward Confirmed	No — PTR hostname does not resolve back to this IP (weak signal)
Forward Hostnames	`proxy-ca014-san61.ahrefs.net`

🔐 DNS Hygiene

Hygiene Score	40% (Fair)
SPF	Not configured
DMARC	Not configured
FCrDNS	Not verified
DNSSEC	Valid
CAA	Present

☁️ Network Classification

Infrastructure	Infrastructure / Datacenter
Service Purpose	Firewalled / No Services
Network Tier	Hosting — Infrastructure provider without advanced routing

CloudHosting

🔌 Services & Open Ports

Port	Service	Protocol	Banner
No open ports detected
Closed Ports	22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned)

Server	—
HTTP Title	—

🔐 TLS Certificate

🔒

No certificate

Issued by —

N/A

SANs	None
Valid From	—
Valid Until	—

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

Dimension	Score	Sources	Observations
threat	29%	2	4
routing	13%	1	1
services	12%	2	2
ownership	19%	2	2
reputation	31%	1	3
geolocation	35%	2	3
Overall	23%	10	15

Coverage: 6/6 dimensions · Data sufficiency: sufficient

Data Coherence	Mostly Consistent (80%) — 1 contradiction(s)
Attribution	Low (35%)
	OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

⚠ Claimed geolocation contradicts RTT physics measurement

📅 Observation Timeline 🔄 Live

First Seen	2026-05-07 23:03:44 UTC
Last Seen	2026-06-26 23:43:20 UTC
Profile Built	2026-06-27 13:57:27 UTC
Data Freshness	Live
Signal Types	21
Total Observations	26

🔍 21 signal types · 26 observations collected

This report is generated from 21+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.

{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.

148.113.128.61📋 Copy