148.113.130.144📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 148.113.130.144/32

Analysis Date: Current Session

Classification: Moderate Risk (Score: 40/100)

---

## EXECUTIVE SUMMARY

IP address 148.113.130.144 is registered to OVH (ASN 16276) under organization "Dmytro, Ahrefs Pte Ltd" and operates within a high-abuse subnet (148.113.130.0/24). The IP presents as a cloud compute infrastructure asset with proxy-style hostname characteristics. Significant geolocation validation anomalies and high subnet abuse density warrant defensive consideration.

---

## TECHNICAL PROFILE

Ownership & Registration

Geolocation Analysis

Assessment: Geolocation data is inconsistent and unreliable. The RTT violation indicates the IP's claimed location does not match network path characteristics.

---

## NETWORK BEHAVIOR

Subnet Characteristics

Assessment: The /24 subnet exhibits elevated abuse activity with 66.8% abuse density. The IP operates within a high-risk network environment.

DNS & Hostname Analysis

• PTR Hostname: proxy-ca009-san144.ahrefs.net
• Forward Resolution: proxy-ca009-san144.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution Confirmed: No
• Observation: "Proxy" naming convention in PTR record is consistent with proxy/scraper infrastructure.

Service Exposure

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• Infrastructure Status: Firewalled / No Services

---

## OBSERVATION HISTORY

Total observations: 21 (June 2026 window)

Key Observations:

1. Infrastructure Classification: Consistent cloud compute classification across observations

2. Abuse Classification: Persistent "high_abuse" subnet classification

3. Geolocation Signals: Multiple conflicting geolocation reports including Canada (CA) and Singapore claims

4. RTT Violations: Recurrent RTT anomalies suggesting location spoofing or inaccurate database entries

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: No
• Threat Observation Count: 1

---

## RELATIONSHIP GRAPH

Total Relationships: 48

• Primary Type: Same Network (OVH-CUST-281059688)
• Associated Networks: Multiple OVH customer network identifiers

Assessment: Extensive network relationships within OVH customer infrastructure. All connections indicate same-network peer relationships rather than external threat associations.

---

## THREAT INDICATORS

Control Plane:

• DNSBL Listed: 1 of 8 total lists
• Operator Score: 0.2174 (Minimal)
• Route Stability: False
• RPKI State: Not Available

---

## DEFENSIVE ACTIONS

Recommended Firewall Rules

Recommended Actions

• Monitor: Subnet 148.113.130.0/24 for elevated activity
• Correlate: Review connected network peers for coordinated behavior
• Context: Evaluate against known Ahrefs/scraper tool infrastructure patterns

---

## ANALYST NOTES

1. Risk Level: The IP presents moderate risk (40/100) primarily due to subnet-level abuse density rather than confirmed malicious activity.

2. False Positive Consideration: The "proxy" hostname and cloud infrastructure placement suggest this may be legitimate proxy/scraper service infrastructure. The organization "Ahrefs" is a legitimate SEO tool provider.

3. Geolocation Anomaly: The RTT violation (27ms for 6,082km distance) represents a clear data quality issue that should be flagged for database correction.

4. Subnet Context: With 171 threat siblings in the /24, blocking the single IP may be justified for risk containment, but subnet-level monitoring is recommended.

5. Action Priority: MEDIUM — No active threat indicators detected, but elevated subnet context warrants defensive blocking with monitoring.

---

Classification: UNCLASSIFIED

Distribution: SOC/Security Operations

Prepared By: IPDebrief Intelligence Analysis

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.