148.113.130.181📋 Copy

# IP Intelligence Briefing: 148.113.130.181/32

Classification: Moderate Risk | Date Generated: 2026-06-29

Assigned Severity: MEDIUM (Risk Score: 40/100)

---

## EXECUTIVE SUMMARY

IP 148.113.130.181 is a cloud infrastructure address owned by Ahrefs Pte Ltd hosted on OVH (ASN: 16276). The IP resolves to a reverse DNS hostname associated with the ahrefs.net domain. While the IP shows no active threat indicators, the /24 subnet exhibits elevated abuse density (0.707), suggesting this address shares network infrastructure with compromised peers. The IP is currently firewalled with no open services detected.

---

## OWNERSHIP & INFRASTRUCTURE

• Organization: Ahrefs Pte Ltd
• Network: OVH-CUST-281059688
• ASN: 16276
• Infrastructure Type: CloudCompute / Hosting
• Location Data: Singapore (geolocation source count: 1)

Note: Geolocation data shows country code "CA" with city "Singapore" — potential data inconsistency requiring validation.

---

## THREAT ASSESSMENT

Risk Profile

• Overall Risk Score: 40/100 (Moderate)
• Abuse Confidence Score: Not available
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0

Threat Indicators

• No active threat campaigns detected
• No known malicious campaigns correlated
• No threat feed matches

Control Plane

• Route Stability: False
• RPKI State: Not available
• DNSSEC Valid: True
• DNSBL Listings: 1 of 8 total lists
• Operator Score: 0.2174 (Minimal)

---

## NEIGHBORHOOD ANALYSIS

Subnet: 148.113.130.0/24

Abuse Density: 0.707 (High)

Classification: High Abuse

Sample Risk Distribution (100 neighbors):

• High Risk: 0
• Medium Risk: 100
• Low Risk: 0

The subnet exhibits consistent medium-risk profiles across sampled neighbors, indicating systemic infrastructure risk rather than isolated IP behavior.

---

## NETWORK SERVICES

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• Service Purpose: Firewalled / No Services

DNS Resolution:

• PTR Hostname: proxy-ca009-san181.ahrefs.net
• Forward Resolution: proxy-ca009-san181.ahrefs.net
• Forward Confirmed: No

---

## OBSERVATION HISTORY

Recent activity shows two primary signal types observed in June 2026:

1. Operator Risk Signals (2026-06-29): Minimal operator score (0.087-0.2174)

2. DNS Observations (2026-06-20): ahrefs.net domain resolution with CAA records confirmed

3. Subnet Abuse Classification (2026-06-20): High abuse classification confirmed with 0.707 abuse density

No persistent threat patterns detected across observation window.

---

## RELATIONSHIP MAPPING

• Network Associations: Multiple "Same Network" relationships to OVH-CUST-281059688
• Total Relationships: 36 identified
• Primary Link: Hosted on OVH customer subnet 148.113.130.0/24

---

## RECOMMENDATIONS FOR SOC ANALYSTS

1. Monitor Subnet Activity: Given high abuse density (0.707) and 181 threat siblings, monitor traffic patterns from adjacent IPs in 148.113.130.0/24

2. Validate Geolocation: Resolve country code/city discrepancy (CA vs. Singapore) through additional intelligence sources

3. DNS Monitoring: Track proxy-ca009-san181.ahrefs.net for anomalous resolution patterns

4. Baseline Establishment: No current threat indicators require immediate blocking, but establish baseline for future anomaly detection

5. Infrastructure Context: This is legitimate cloud infrastructure for Ahrefs; false positives likely if blocking based solely on IP reputation

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.