148.113.130.196📋 Copy

# THREAT INTELLIGENCE BRIEFING

Target: 148.113.130.196/32

Classification: Moderate Risk / Cloud Hosting Infrastructure

Date: [Current Date]

---

## EXECUTIVE SUMMARY

IP address 148.113.130.196 is a cloud compute infrastructure endpoint hosted on OVH network (ASN 16276) with moderate risk scoring (40/100). The IP resolves to aresolves to a domain associated with Ahrefs (proxy-ca009-san196.ahrefs.net) and is hosted in cloud infrastructure with no open services. However, the IP operates within a subnet (148.113.130.0/24) exhibiting high abuse density (60.55%) with 155 of 256 total siblings classified as threat indicators.

---

## OWNERSHIP & INFRASTRUCTURE

---

## NETWORK CLASSIFICATION

• Provider: OVH
• Connection Type: Cloud-hosted infrastructure
• Service Status: Firewalled / No Services Detected
• DNS Records: ptrHostnames: proxy-ca009-san196.ahrefs.net
• Forward Resolution: proxy-ca009-san196.ahrefs.net (confirmed)
• Open Ports: None detected
• TLS Certificates: Not observed

---

## THREAT ASSESSMENT

Current Risk Profile

• Overall Risk Score: 40/100 (Moderate Risk)
• Abuse Confidence Score: Not scored
• Blacklist Status: Listed on 1 of 8 DNSBL checks
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No

Control Plane Analysis

• Origin ASN: 16276
• BGP Prefix: 148.113.128.0/17
• Route Stability: Stable (0 changes in 30 days)
• DNSSEC: Valid
• RPKI State: Not verified
• Operator Score: 0.2174 (Minimal)

---

## NEIGHBORHOOD CONTEXT

The target IP resides in subnet 148.113.130.0/24 with concerning abuse characteristics:

This indicates 60% of the subnet has been flagged as threats, with 155 IPs in the /24 classified as malicious.

---

## OBSERVATION HISTORY

Total Observations: 22 signals collected

Recent activity shows:

• June 20, 2026: Operator score 0.2174 (Minimal), 3 signals detected
• June 15, 2026: Subnet abuse density signal (0.6055, high_abuse classification)
• Geolocation Validation: RTT violation detected (27ms observed vs. 121.6ms minimum possible for 6082km distance), indicating potential geolocation spoofing or routing anomalies

No persistent malicious activity detected over observation period.

---

## RELATIONSHIP ANALYSIS

The IP maintains 37 relationship records, primarily mapping to the same network assignment (OVH-CUST-281059688). No direct relationships to external hostnames, organizations, or certificates beyond network-level associations.

---

## ACTIONABLE RECOMMENDATIONS

For SOC Analysts

1. Monitor, not block immediately – Moderate risk score with no active threat indicators

2. Investigate subnet context – 155 threat siblings in /24 may indicate broader compromise

3. Validate geolocation claims – Significant RTT violation suggests potential spoofing or misattribution

4. Monitor DNS activity – Single DNSBL listing warrants observation for campaign correlation

Firewall/Network Recommendations

• Allow traffic if legitimate business need exists (Ahrefs-associated domain)
• No immediate blocking required based on current risk profile
• Consider monitoring for outbound connections from this IP to known C2 infrastructure

---

## CONFIDENCE LEVELS

• Ownership Attribution: High confidence (OVH network assignment confirmed)
• Risk Scoring: Medium confidence (single observation point)
• Geolocation: Low confidence (RTT violation detected)
• Threat Status: Medium confidence (subnet-level indicators present, IP-level clean)

---

BRIEFING COMPLETE

*Data sourced from IPDebrief intelligence platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.