148.113.130.218📋 Copy

IP INTELLIGENCE BRIEFING: 148.113.130.218/32

EXECUTIVE SUMMARY

IP address 148.113.130.218 presents moderate risk (50/100) with multiple threat indicators. Hosted on OVH Cloud infrastructure in Singapore (geolocation confidence low), the IP resolves to Ahrefs.net with no active services detected. Listed on 2 of 8 DNSBL threat feeds with high-severity listings. The /24 subnet exhibits high abuse density (0.5977) with 153 threat-sibling IPs among 210 active peers.

TECHNICAL PROFILE

• Owner: Dmytro, Ahrefs Pte Ltd (ASN 16276)
• Network: OVH-CUST-281059688 (148.113.130.0/24)
• Infrastructure: Cloud compute/hosting provider
• DNS: proxy-ca009-san218.ahrefs.net (forward resolution confirmed)
• Services: No open ports detected; firewall blocking active
• Control Plane: Route unstable (changes observed in 30 days); MOAS pattern detected

THREAT INDICATORS

• DNSBL Listings: 2 active listings across 8 threat feeds
• Abuse Classification: Subnet marked as high_abuse; inherited risk score: 23
• Geolocation Anomaly: Listed CA/Singapore with 3000km accuracy radius; RTT violation detected (29ms measured vs 121.6ms minimum for 6082km)
• Threat Siblings: 153 malicious IPs identified in /24 neighborhood
• Observation History: 23 signals recorded; 1 threat observation; not persistently malicious

NEIGHBORHOOD ANALYSIS

Sample of 100 neighbors shows consistent medium-risk classification (100/100). Abuse density metrics indicate concentrated threat activity within the subnet. All sampled neighbors (148.113.130.0-130.4) exhibit risk scores of 40-50 with authority scores of 50.

SOC ACTIONS RECOMMENDED

1. Monitor: No immediate block required; moderate risk level

2. Correlate: Investigate connections to proxy-ca009-san218.ahrefs.net

3. DNSBL Review: Verify 2 active blacklist listings for potential false positives

4. Subnet Context: Consider broader subnet 148.113.130.0/24 for correlation analysis given high abuse density

5. Geolocation Validation: Low confidence geolocation requires manual verification

RISK ASSESSMENT

The IP represents infrastructure-level hosting on a known provider with elevated neighborhood abuse metrics. While not directly malicious, the combination of DNSBL listings and high-threat sibling concentration warrants defensive monitoring. No active attack campaigns or known associations detected.

*Report generated: 2026-06-25 | Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.