148.113.130.248📋 Copy

## IP Intelligence Briefing: 148.113.130.248/32

Classification: Moderate Risk (Score: 40/100)

Date: 2026-06-25

Executive Summary

The target IP 148.113.130.248 is hosted on OVH cloud infrastructure under the Ahrefs organization. While the IP itself shows moderate risk characteristics, its /24 subnet demonstrates elevated abuse density (0.5117) with 131 threat-identified siblings out of 256 total IPs. Geographic validation anomalies and inconsistent DNS records suggest potential misconfiguration or malicious exploitation of cloud hosting resources.

Network Ownership and Classification

• Provider: OVH (Cloud Compute infrastructure)
• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276
• CIDR Block: 148.113.130.0/24
• Infrastructure Type: Cloud hosting with firewalled/no services exposure
• Network Classification: Not bogon, not residential, not mobile

Geolocation Discrepancies

• Reported Country: CA (Canada)
• Reported City: Singapore
• Validation Status: FAILED
• RTT Violation: Observed 30ms RTT vs minimum possible 121.6ms for 6082km distance
• GeoPlausible: False
• GeoConsensus: False (2 sources, conflicting data)

This geographic inconsistency indicates either data spoofing, misconfigured geolocation services, or compromised routing.

DNS and Service Analysis

• PTR Hostname: proxy-ca009-san248.ahrefs.net
• Forward Resolution: Confirmed to ahrefs.net
• Email Security: No SPF or DMARC records configured
• Open Ports: None detected (firewalled)
• HTTP/TLS: No active services detected

Threat Intelligence Indicators

• Blacklist Status: Listed on 1 of 8 DNSBL feeds
• Tor Exit: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: None identified
• Threat Observation Count: 1

Neighborhood Analysis (148.113.130.0/24)

• Subnet Abuse Density: 0.5117 (High)
• Classification: high_abuse
• Active Siblings: 162 of 256 total
• Threat Siblings: 131
• Risk Distribution: 100 medium-risk neighbors, 0 high/low

The subnet exhibits significant abuse patterns, suggesting either shared compromised infrastructure or a high-value target for abuse.

Historical Observations (23 signals tracked)

Recent monitoring reveals consistent presence across threat feeds with one observation (2026-06-25) showing 8 total blacklist listings with high severity ratings. Operator scores remain minimal (0.2174), but the subnet-level context elevates risk classification.

Recommended Security Actions

Based on risk profile, the following blocking rules are recommended:

Analyst Notes

Consider implementing subnet-level blocking (148.113.130.0/24) if the organization is not the legitimate cloud customer. The combination of geographic validation failures, minimal operator scores, and high neighborhood abuse density suggests this IP may be part of a compromised or misused cloud hosting environment. Monitor for correlation with other ahrefs.net infrastructure.

---

*Intelligence generated by IPDebrief. Review recommendations in context of organizational security posture.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.