148.113.130.118📋 Copy

# INTELLIGENCE BRIEFING: 148.113.130.118/32

## EXECUTIVE SUMMARY

IP address 148.113.130.118 presents a MODERATE RISK profile (score: 40/100) associated with OVH cloud hosting infrastructure. The IP is part of a high-abuse density subnet (/24) with significant malicious activity correlation. No active services currently detected; IP appears firewalled.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 148.113.130.0/24
• Infrastructure Type: Cloud Compute / Hosting
• DNS Resolves: proxy-ca009-san118.ahrefs.net (Ahrefs brand)

---

## THREAT INDICATORS

• DNSBL Listings: 1 of 8 threat lists (active)
• Abuse Confidence: Elevation due to neighborhood correlation
• Blacklist Status: Previously listed with high severity (observed 2026-06-26)
• Campaign Association: None identified
• Known Attacker: No
• Tor Exit/Proxy: No

---

## NETWORK CONTEXT

Subnet Abuse Profile (148.113.130.0/24):

• Classification: HIGH ABUSE
• Abuse Density Score: 0.5977 (significant)
• Total Subnet Siblings: 256
• Active Siblings: 211
• Threat Correlation Siblings: 153

Geolocation Discrepancy: ASN registration indicates Canada, but geolocation data shows Singapore. This may indicate infrastructure hosting in Singapore with Canadian ASN allocation, or data inconsistency.

---

## OBSERVATION HISTORY

Total signals: 23

• Recent blacklist activity confirmed (June 2026)
• Network classification consistently shows hosting infrastructure
• No persistent malicious activity detected over observation window

---

## RECOMMENDED ACTIONS

Firewall Rules

```bash

# DROP traffic from this IP

iptables -A INPUT -s 148.113.130.118 -j DROP

# Or allow-list if legitimate Ahrefs traffic required

iptables -A INPUT -s 148.113.130.118 -j ACCEPT

```

Security Advisory

1. Monitor for lateral movement: The /24 subnet shows 59% abuse density; correlate with other 148.113.130.x addresses

2. DNSBL validation: Confirm listing source for whitelist/delistment decisions

3. Traffic pattern analysis: No open services detected; verify if expected behavior for Ahrefs infrastructure

4. Geolocation verification: Investigate Canada/Singapore discrepancy for potential infrastructure changes

---

## RISK ASSESSMENT

Current Status: MODERATE RISK (40/100)

Neighborhood Inherited Risk: 23/100

Threat Persistence: Low

Recommended Priority: MEDIUM - Monitor for service activation or new threat indicators

---

*Report generated: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.