148.113.130.189📋 Copy

# IP Intelligence Briefing: 148.113.130.189/32

Classification: Moderate Risk / High-Abuse Subnet Environment

Risk Score: 40/100

Last Updated: 2026-06-20

## Executive Summary

IP 148.113.130.189 is a cloud-hosted infrastructure endpoint associated with OVH network (ASN 16276). The IP operates within a high-abuse density subnet (68.75% abuse density) and presents a moderate risk profile. While no direct threat indicators or active campaigns were detected, the operational environment warrants defensive consideration.

## Network and Infrastructure Profile

## Geolocation Discrepancy Analysis

Critical geolocation validation failure detected:

• Claimed Location: Singapore
• Observed RTT: 26ms average
• Geographically Implausible: Minimum possible RTT for claimed distance (6,082 km) is 121.6ms
• Validation Status: GEO_PLAUSSIBLE = FALSE

This discrepancy indicates the IP is likely being misreported or is operating from a location different than claimed.

## Threat Indicators Assessment

Note: No active threat indicators detected, though the operational context (high-abuse subnet) requires monitoring.

## Subnet Environment Analysis

The parent subnet /24 exhibits elevated abuse characteristics:

• Active Siblings: 209 out of 256 IPs
• Threat-Scored Siblings: 176 IPs
• Subnet Risk: 68.75% abuse density (classified as HIGH_ABUSE)
• Inherited Risk Score: 27/100

This indicates the IP operates in an environment with significant malicious activity, suggesting the possibility of compromised co-hosted infrastructure.

## DNS Resolution

• PTR Hostname: proxy-ca009-san189.ahrefs.net
• Resolved Domain: ahrefs.net
• Forward Resolution: Single record confirmed

## Recommended Security Actions

Defensive blocking is recommended due to moderate risk score and high-abuse subnet environment:

## Intelligence Assessment

This IP should be treated as a potential risk due to:

1. Operation in a high-abuse density subnet (68.75%)

2. Geolocation validation failure indicating possible obfuscation

3. Cloud-hosted infrastructure commonly utilized by both legitimate and malicious actors

Recommendation: Apply defensive blocking measures. Monitor for any behavioral changes or emergence of threat indicators. Consider blocking the broader /24 subnet if operational requirements permit, given the 68.75% abuse density.

---

*Intelligence generated from IPDebrief threat data. Rules should be validated against operational requirements before deployment.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.