148.113.130.161📋 Copy

# IP Intelligence Briefing: 148.113.130.161/32

Classification: Moderate Risk | Status: Active Monitoring Recommended

---

## Executive Summary

IP address 148.113.130.161 is assigned to OVH network infrastructure under customer organization "Dmytro, Ahrefs Pte Ltd" (ASN 16276). The IP presents moderate risk (score: 50) with evidence of DNSBL listings and geolocation inconsistencies. The /24 subnet exhibits elevated abuse density (0.5195), with 133 of 256 active siblings flagged as threats.

---

## Infrastructure Profile

---

## Threat Indicators

• DNSBL Listings: 2 of 8 total lists (high severity)
• Abuse Confidence Score: Pending verification
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Correlation: None identified

---

## Geolocation Analysis

• Reported Location: Singapore (CA)
• Validation Status: ⚠️ FAILED
• RTT Violation: 32.0ms observed vs 121.6ms minimum required for 6,082km distance
• Conclusion: Geolocation data is inconsistent; actual location does not match reported Singapore coordinates.

---

## Network Intelligence

DNS Resolution:

• PTR Hostname: proxy-ca009-san161.ahrefs.net
• Forward Resolves: proxy-ca009-san161.ahrefs.net
• Domain: ahrefs.net

Network Role:

• Hosting: Yes
• Cloud Infrastructure: Yes
• Anycast: No

---

## Observation History (21 signals)

Recent Activity:

• 2026-06-20: Operator score 0.2174 (Minimal); DNSSEC validated
• 2026-06-16: 2 DNSBL listings with high severity ratings; CAA records present for ahrefs.net

Temporal Analysis:

• Threat Persistence: 0 days
• Ownership Changes: 0
• Not persistently malicious

---

## Neighborhood Analysis

Subnet: 148.113.130.0/24

• Abuse Density: 0.5195 (High)
• Active Siblings: 163 of 256
• Threat Siblings: 133
• Risk Distribution: 0 High / 98 Medium / 2 Low

Notable Neighbors:

• 148.113.130.0–4: Risk score 40 (Medium)

---

## Security Recommendations

1. Monitor Closely: The high abuse density of the /24 subnet warrants enhanced monitoring for traffic patterns.

2. Geolocation Discrepancy: Investigate actual physical location; false geolocation may indicate anonymization or misrepresentation.

3. DNSBL Verification: Confirm current blacklist status across major feeds; two listings detected.

4. Traffic Analysis: Monitor for outbound connections to known malicious infrastructure.

5. Network Context: The ahrefs.net domain association suggests potential legitimate use, but the hosting environment and abuse density warrant caution.

---

Analysis Date: Current session

Data Sources: IPDebrief Intelligence Platform

Confidence Level: High (21 historical observations)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.