148.113.130.20📋 Copy

# IP Intelligence Briefing: 148.113.130.20/32

Classification: Moderate Risk (Score: 40)

Date: 2026-06-22

## Executive Summary

IP 148.113.130.20 is a cloud compute endpoint hosted on OVH infrastructure (AS16276) showing moderate-risk indicators. The IP exhibits geolocation validation anomalies and operates within a high-abuse density subnet. No active services detected; traffic appears firewalled.

---

## Technical Profile

Ownership & Registration:

• ASN: 16276 (OVH SAS)
• Organization: OVH-CUST-281059688
• CIDR Block: 148.113.130.0/24
• RIR: ARIN

Geolocation:

• Country: Canada (CA)
• Region: Quebec (QC)
• City: Beauharnois
• *Critical Finding:* RTT validation violation observed (21ms measured vs 121.6ms minimum required for 6082km distance), indicating potential spoofing or inaccurate geolocation data.

Network Classification:

• Provider: OVH
• Infrastructure Type: CloudCompute
• Connection Type: Firewalled / No Services
• DNS Resolution: proxy-ca009-san20.ahrefs.net (ahrefs.net)

---

## Threat Indicators

Threat Signals:

• DNSBL Listed: 1 of 8 total lists
• Abuse Confidence: Not explicitly scored
• Known Campaigns: None identified
• Tor Exit/Proxy: Negative

Control Plane:

• BGP Prefix: 148.113.128.0/17
• Operator Score: 0.2174 (Minimal)
• Route Stability: False (route changes detected)
• DNSSEC: Valid

---

## Neighborhood Analysis

Subnet: 148.113.130.0/24

• Abuse Density: 0.6367 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 204
• Threat Siblings: 163
• Inherited Risk Score: 25

Risk Distribution (Sample Neighbors):

• High Risk: 0
• Medium Risk: 100 (e.g., 148.113.130.0 through 148.113.130.4)
• Low Risk: 0

---

## Historical Observations

Observation Count: 23 signals tracked

Recent Signals:

• 2026-06-22: High abuse classification (density 0.6523, inherited risk 26)
• 2026-06-18: High abuse classification (density 0.6367, inherited risk 25)
• ASN consistently identified as AS16276 (OVH SAS)
• Multiple AlienVault OTX threat pulses correlated

---

## Relationships

Total Relationships: 47

• Primary relationship type: Same Network (OVH-CUST-281059688)
• No significant organizational or certificate-based relationships identified

---

## Recommended Actions

Immediate Mitigation:

Block the IP at perimeter firewalls and WAFs due to elevated neighborhood risk and geolocation anomalies.

Platform-Specific Rules:

---

## Intelligence Assessment

Key Findings:

1. Geolocation Anomaly: RTT validation failure suggests potential spoofing or misreported location

2. High-Risk Neighborhood: Subnet exhibits 63.67% abuse density with 163 active threat siblings

3. Service Evasion: No open ports detected; traffic appears deliberately firewalled

4. DNS Correlation: Associated with ahrefs.net infrastructure (SEO/Marketing tool provider)

Recommendation: Monitor subnet 148.113.130.0/24 for lateral threats. Consider blocking entire /24 if traffic patterns justify broader containment.

---

*Intelligence generated by IPDebrief threat analysis platform.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.