148.113.130.146📋 Copy

INTELLIGENCE BRIEFING: 148.113.130.146/32

---

Classification: Moderate Risk / Cloud Infrastructure

Report Date: Current

Risk Score: 40/100

---

EXECUTIVE SUMMARY

IP address 148.113.130.146 is a cloud-hosted endpoint associated with Ahrefs Pte Ltd (OVH infrastructure) presenting moderate risk (score: 40). The IP is located within a subnet exhibiting high abuse density (0.5586), with 143 of 256 sibling IPs classified as threats. Despite this contextual risk, the endpoint itself is currently firewalled with no open services detected.

---

OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network: OVH-CUST-281059688 (148.113.130.0/24)
• Infrastructure Type: CloudCompute / Hosting
• Geolocation: Singapore (CA) — 3,000 km accuracy radius
• Provider: OVH (Cloud provider)

---

THREAT INDICATORS

• Reputation: Moderate Risk
• DNSBL Listed: 1/8 lists
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Threat Feeds: None
• Campaign Correlation: None detected
• Blacklist Count: 0

Historical Context:

• Total observations: 21
• Threat observation count: 1
• Persistently malicious: False
• Risk trend: Stable (no significant escalation)

---

NETWORK CONTEXT & NEIGHBORHOOD ANALYSIS

The endpoint resides in subnet 148.113.130.0/24 with elevated abuse characteristics:

• Subnet Abuse Density: 0.5586 (High)
• Active Siblings: 163 of 256
• Threat Siblings: 143
• Inherited Risk Score: 22

Risk distribution among neighbors:

• High risk: 0
• Medium risk: 98
• Low risk: 2

This indicates the subnet is predominantly utilized for legitimate enterprise hosting (Ahrefs infrastructure) but maintains a significant abuse footprint.

---

DNS & RESOLUTION DATA

• PTR Hostname: proxy-ca009-san146.ahrefs.net
• Forward Resolved: ahrefs.net (confirmed)
• Forward Hostnames: proxy-ca009-san146.ahrefs.net
• Forward Resolution Count: 1
• Email Auth: SPF: None, DMARC: None

---

SERVICES & NETWORK ROLE

• Open Ports: None detected
• Services: Firewalled / No Services
• CDN/Proxy/Vpn: False
• Mobile/Residential: False
• Infrastructure Status: Operational cloud endpoint

---

RELATIONSHIP GRAPH

• Total Relationships: 37
• Primary Association: Same Network (OVH-CUST-281059688) — 32+ instances
• No external organization or certificate correlations beyond network boundaries

---

RECOMMENDED ACTIONS

Based on current risk profile and neighborhood context, consider the following:

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 148.113.130.146 -j DROP

# nftables

nft add rule inet filter input ip saddr 148.113.130.146 drop

```

WAF/Proxy Recommendations:

• Cloudflare WAF: Block with risk score 40
• AWS WAF: Block CIDR 148.113.130.146/32
• PFSense: Block 148.113.130.146/32
• Nginx: deny 148.113.130.146

Assessment: Blocking is recommended due to subnet-level abuse density, though the endpoint shows no active malicious indicators. Monitor for changes in threat status.

---

ENDNOTES

This IP should be treated with caution due to subnet abuse characteristics. While the endpoint itself is not actively malicious, the high-density abuse environment suggests potential for compromise or misuse. SOC teams should monitor for any changes in DNS, port, or threat indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.