148.113.130.206📋 Copy

IP INTELLIGENCE BRIEFING

IP Address: 148.113.130.206/32

Date: 2026-06-28

Classification: Moderate Risk (Score: 40)

---

EXECUTIVE SUMMARY

The IP address 148.113.130.206 is hosted on OVH cloud infrastructure (ASN 16276, Org: Dmytro, Ahrefs Pte Ltd) with moderate risk classification. The IP resolves to proxy-ca009-san206.ahrefs.net and shows no active services. While the individual IP presents limited threat indicators, its /24 subnet (148.113.130.0/24) exhibits elevated abuse density, suggesting shared infrastructure risk.

---

OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Name: OVH-CUST-281059688
• CIDR Block: 148.113.130.0/24
• Infrastructure Type: CloudCompute (OVH hosting)
• Geolocation: Singapore (Geo consensus: true)

---

THREAT INDICATORS

• Risk Score: 40/100 (Moderate Risk)
• Abuse Confidence Score: Not available
• Blacklist Status: 0 entries
• Tor/Proxy/Vpn: Not detected
• Known Attacker: No
• Spam Source: No
• DNSBL Listed: 1 of 8 lists
• Open Ports/Services: None detected (Firewalled/No Services)
• TLS Certificate: Not present

---

SUBNET ANALYSIS (148.113.130.0/24)

• Abuse Density: 0.6875 (High)
• Threat Siblings: 176 of 256 IPs (69% threat rate)
• Active Siblings: 209
• Neighbor Risk Distribution: 100 medium risk, 0 high, 0 low
• Inherited Risk: 27

Assessment: The /24 subnet demonstrates significant abuse concentration. While this specific IP shows minimal operator risk (0.2174), the shared infrastructure environment warrants heightened monitoring.

---

OBSERVATION HISTORY

• Total Observations: 22
• Recent Activity: 2026-06-28 (latest signals)
• Operator Score Trend: Minimal (0.087-0.1)
• Subnet Classification: Consistently classified as "high_abuse" since 2026-06-20
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0

---

NETWORK RELATIONSHIPS

• DNS Resolutions: proxy-ca009-san206.ahrefs.net → ahrefs.net
• Route Stability: False
• BGP Prefix: 148.113.128.0/17
• Related Entities: Multiple OVH-CUST-281059688 network associations

---

RECOMMENDED ACTIONS

1. Monitoring: Place IP under enhanced monitoring due to high-abuse subnet context

2. Firewall Rules: Consider rate-limiting or geo-blocking if applicable to your threat profile

3. Correlation: Investigate other IPs in 148.113.130.0/24 for potential coordinated activity

4. DNS Monitoring: Monitor ahrefs.net domain for anomalous DNS traffic from this subnet

5. No Immediate Block: Individual IP lacks direct threat indicators; block based on subnet policy if required

---

SOC ANALYST NOTES

This IP presents a shared-risk scenario. The absence of direct threat indicators (blacklists, known campaigns) is offset by the high-abuse density of the parent subnet. Investigate any traffic from this IP in context of broader subnet activity. No immediate blocking recommended unless organizational policy restricts OVH cloud hosting.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.