148.113.130.107📋 Copy

IP INTELLIGENCE BRIEFING: 148.113.130.107

Classification: Moderate Risk | Risk Score: 40/100 | Status: Active

---

**Ownership & Infrastructure**

• Organization: Dmytro, Ahrefs Pte Ltd (OVH customer)
• ASN: 16276 (OVH)
• CIDR Block: 148.113.130.0/24
• Network Role: Hosting provider environment; no open services detected
• Classification: isHosting=true; servicePurpose="Firewalled / No Services"

**Geolocation Analysis**

• Reported Location: Canada (CA) with coordinates 43.63°N, -79.37°W
• Geo Validation: ⚠️ VIOLATION DETECTED

- Claimed distance: 6,082 km from probe origin

- Minimum possible RTT: 121.6 ms

- Observed RTT: 23.0 ms

- Conclusion: Geolocation data is implausible; likely false location reporting

**Threat Intelligence**

• Known Threats: None identified
• Blacklist Status: Listed on 1 of 8 DNSBL feeds
• Threat Indicators: No known campaigns, attacker signatures, or spam source activity
• Tor/Proxy: Not a Tor exit node; not classified as proxy or VPN
• Abuse Confidence: Inherited risk score of 20 from subnet context

**Subnet Context (148.113.130.0/24)**

• Abuse Density: 0.5195 (HIGH)
• Classification: high_abuse
• Active Siblings: 162 out of 256 total
• Threat Siblings: 133 IPs flagged as threats
• Risk Distribution: 97 medium-risk neighbors, 3 low-risk, 0 high-risk
• Inherited Risk: 20/100

**DNS & Network Behavior**

• PTR Record: proxy-ca009-san107.ahrefs.net
• Forward Resolution: Confirmed (ahrefs.net)
• Open Ports: None detected
• TLS/Certificates: Not available
• HTTP Status: No active web services

**Temporal Analysis**

• Observations: 20 recent signals collected
• Ownership Changes: 0 changes recorded
• Threat Persistence: Single observation event; not persistently malicious
• Route Stability: Route changes observed in 30-day window

**Recommended Actions**

Based on moderate risk score (40) and high-abuse subnet context:

```bash

# Firewall Block Rules

iptables -A INPUT -s 148.113.130.107 -j DROP

nft add rule inet filter input ip saddr 148.113.130.107 drop

# Application Layer

nginx: deny 148.113.130.107;

pfSense: 148.113.130.107/32

# WAF Integration

Cloudflare WAF: Block with expression: ip.src eq 148.113.130.107

AWS WAF: Add 148.113.130.107/32 to block list

```

---

**Analyst Assessment**

This IP is hosted within OVH's high-abuse subnet (148.113.130.0/24), which shows significant abuse density. However, the specific IP has no direct threat indicators and is associated with legitimate Ahrefs infrastructure. The geolocation data shows clear inconsistencies suggesting potential location spoofing.

Recommended Action: Monitor traffic patterns from this IP. Given the moderate risk score (40) and lack of direct threat indicators, consider blocking at network perimeter while maintaining observability. Subnet-level abuse context warrants heightened scrutiny for similar IPs within 148.113.130.0/24.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.