148.113.130.208📋 Copy

IP Intelligence Briefing: 148.113.130.208/32

*Generated via IPDebrief tools: Profile, History, Relationships, & Neighborhood Analysis*

---

**Key Findings**

1. Ownership & Network Role

- Provider: OVH (ASN 16276)

- Network: Subnet `148.113.130.0/24`, classified as "mixed" (normal + potential abuse).

- Purpose: Cloud compute instance (OVH hosting), no residential/mobile traffic.

- DNS: Linked to `proxy-ca009-san208.ahrefs.net` (Ahrefs Pte Ltd).

2. Geolocation Discrepancy

- Reported Country: Canada (CA)

- City: Singapore (via DNS resolution)

- RTT Anomaly: 27ms latency inconsistent with 6,082km distance (minimum plausible RTT: 121.6ms).

- GeoPlausibility: False (likely misconfigured or spoofed location).

3. Threat Indicators

- No Direct Malicious Activity: No indicators of spam, attacks, or known campaigns.

- Subnet Risk: 29% abuse density; 74 of 252 sibling IPs show threat activity.

- DNS Security: DNSSEC valid, but no email authentication (SPF/DKIM/MX) detected.

4. Historical Observations

- Recent Activity: 18 signals recorded (June 1–10, 2026).

- Notable:

- DNS resolution and route validation anomalies (RTT mismatch).

- Subnet abuse density flagged as "mixed" with inherited risk.

5. Relationships

- Connected Entities:

- Same network (`OVH-CUST-281059688`).

- DNS hostname `proxy-ca009-san208.ahrefs.net` (Ahrefs).

- No Known Campaigns or Malware Signatures.

---

**Actionable Insights**

• Monitor Subnet: The `/24` subnet has 29% abuse density; prioritize monitoring high-risk siblings (74/252).
• Investigate Geolocation Discrepancy: The RTT anomaly and conflicting location data may indicate misconfiguration or spoofing.
• Verify DNS Configuration: Ensure `proxy-ca009-san208.ahrefs.net` is legitimate and not used for obfuscation.
• Check for Anomalies: No direct threats, but the cloud-hosted IP’s mixed subnet and RTT issues warrant closer scrutiny.

---

**Recommendations**

• SOC Analyst Actions:

- Correlate this IP with internal logs for unusual traffic patterns.

- Validate DNS resolution and geolocation data with additional tools.

- Flag the subnet for deeper analysis due to inherited risk.

• Firewall Rules:

- Consider blocking high-risk siblings in the `148.113.130.0/24` subnet if traffic is suspicious.

Note: This IP appears legitimate but requires ongoing monitoring due to conflicting geolocation data and subnet risk.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.