148.113.130.125📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 148.113.130.125/32

Date: 2026-06-14

Risk Classification: MODERATE RISK (Score: 40/100)

---

## EXECUTIVE SUMMARY

IP address 148.113.130.125 is a cloud-based hosting IP registered to OVH (AS16276), associated with organization "Dmytro, Ahrefs Pte Ltd." The IP resolves to ahostname proxy-ca009-san125.ahrefs.net under the ahrefs.net domain. Current threat indicators are absent, though the IP resides within a high-abuse density subnet (51.17%) with 131 threat siblings in the /24 block.

---

## OWNERSHIP & INFRASTRUCTURE

Geolocation Anomaly Detected:

• Registered Country: Canada (CA)
• Reported Location: Singapore
• Accuracy Radius: 3000km
• This discrepancy warrants further validation.

---

## THREAT ASSESSMENT

Risk Indicators

• Current Threat Status: No active threat indicators
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Listings: 1 of 8 lists

Network Context

• Subnet Classification: HIGH_ABUSE
• Abuse Density: 0.5117 (51.17%)
• Threat Siblings: 131 / 256 IPs in /24
• Inherited Risk Score: 20

Service Exposure

• Open Ports: None detected
• Service Purpose: Firewalled / No Services
• SSL/TLS: No certificates detected
• HTTP Services: No active services

---

## OBSERVATION HISTORY

Total Observations: 21 signals

Recent Activity (2026-06-14):

• Cloud/hosting classification confirmed
• Ahrefs.net DNS resolution verified
• Abuse density signal confirmed at 0.5117
• Operator score: 0.2174 (Minimal)
• 6 coverage dimensions with 100% data sufficiency

Temporal Analysis:

• Ownership Changes: 0 (Stable)
• Threat Persistence: 0 days
• Persistent Malicious: False
• Threat Observation Count: 1

---

## RELATIONSHIP GRAPH

Identified Relationships (40 total):

• Same Network: OVH-CUST-281059688 (35 instances)

No unique organizational or hostname relationships detected beyond network-level associations.

---

## NEIGHBORHOOD ANALYSIS

Sampled Neighbors: 100 IPs from /24 block

Risk Distribution:

• High Risk: 0
• Medium Risk: 97
• Low Risk: 3

Key Neighbor IPs (Risk Score: 40):

• 148.113.130.0, 148.113.130.1, 148.113.130.2, 148.113.130.3, 148.113.130.4

The /24 block exhibits consistent risk scoring across multiple IPs, suggesting a shared hosting infrastructure with elevated abuse potential.

---

## RECOMMENDED ACTIONS

Immediate Mitigation

Strategic Considerations

1. Subnet-Level Blocking: Consider blocking entire /24 block (148.113.130.0/24) due to 51.17% abuse density and consistent risk scoring across sibling IPs.

2. Geolocation Validation: Investigate Canada vs. Singapore geolocation discrepancy. This may indicate spoofed or misconfigured infrastructure.

3. Ahrefs Association: IP resolves to ahrefs.net infrastructure. Legitimate traffic from Ahrefs should be evaluated against organizational policies before blocking.

4. Risk Threshold: Score of 40 indicates moderate risk—actionable but requires context-aware implementation.

---

## CONCLUSION

IP 148.113.130.125 represents a moderate-risk cloud hosting endpoint within a high-abuse density subnet. While current threat indicators are absent, the subnet's 51.17% abuse density and 131 threat siblings justify defensive blocking. The geolocation discrepancy and Ahrefs association require correlation with internal threat intelligence before implementing permanent blocks.

Recommended Priority: MEDIUM

Action Required: Implement blocking rules with monitoring for legitimate traffic patterns.

---

*Generated by IPDebrief Intelligence Analysis Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.