148.113.130.254📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 148.113.130.254/32

Classification: MODERATE RISK - Cloud Hosting Infrastructure

Date: 2026-06-25

Prepared by: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

IP address 148.113.130.254 is an OVH cloud hosting infrastructure endpoint associated with Ahrefs Pte Ltd. While the IP shows no direct threat indicators, it resides within a /24 subnet exhibiting high abuse density (0.6367). The IP maintains a risk score of 40/100 and currently has no active services (firewalled). Historical analysis indicates consistent cloud hosting classification with no escalation in threat profile over the observation period.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 148.113.130.0/24
• Infrastructure Type: Cloud Computing (OVH Hosting)
• Provider: OVH
• BGP Prefix: 148.113.128.0/17
• Route Stability: Stable (no changes in 30 days)

---

## NETWORK CLASSIFICATION

• Cloud Environment: YES
• CDN: NO
• Proxy/VPN: NO
• Tor Exit Node: NO
• Hosting Provider: YES
• Mobile Carrier: NO
• Residential: NO
• Bogon Address: NO

---

## DNS & NETWORK SERVICES

• PTR Hostname: proxy-ca009-san254.ahrefs.net
• Forward Resolution: ahrefs.net (1 record)
• Open Ports: None detected (firewalled)
• HTTP Services: None active
• TLS Certificates: None
• Email Authentication: SPF/DMARC not configured
• DNSSEC: Valid
• CAA Records: Present

---

## THREAT INDICATORS

---

## NEIGHBORHOOD ANALYSIS (148.113.130.0/24)

• Total Subnet IPs: 256
• Active Siblings: 204
• Threat Siblings: 163
• Abuse Density Score: 0.6367 (High Abuse Classification)
• Inherited Risk: 25/100
• Neighbor Risk Distribution: 100 Medium Risk, 0 High Risk, 0 Low Risk

Key Finding: This IP shares a subnet with 163 known malicious endpoints, indicating elevated risk through neighborhood association despite lack of direct threat indicators.

---

## GEOGRAPHIC ANALYSIS

• Reported Country: CA (Canada)
• Reported City: Singapore
• Geographic Discrepancy: DETECTED - Location signals inconsistent with RTT measurements
• Minimum Possible RTT: 121.6ms for 6082km distance
• Observed RTT: 25ms (implies geographic mismatch)
• Probe Count: 5
• Conclusion: Geographic data validation failed; actual server location cannot be confirmed through triangulation

---

## OBSERVATION HISTORY (29 Total Signals)

Timeline Analysis:

• Most Recent: 2026-06-25T10:59:28Z
• Infrastructure Signal: Cloud hosting provider confirmed
• Abuse Density Signal: 2026-06-19 (High Abuse Classification)
• Route Stability: Maintained throughout observation period
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0

Risk Trajectory: STABLE - No escalation or degradation in risk profile during observation window.

---

## RECOMMENDED ACTIONS

Threat Level: MODERATE

Action Required: MONITOR / BLOCK BASED ON POLICY

Firewall Rules Generated:

iptables:

```bash

iptables -A INPUT -s 148.113.130.254 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 148.113.130.254 drop

```

nginx:

```nginx

deny 148.113.130.254;

```

pfSense:

```

148.113.130.254/32

```

Cloudflare WAF:

```json

{"description":"Block 148.113.130.254 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 148.113.130.254"}}

```

AWS WAF:

```json

{"Addresses":["148.113.130.254/32"],"Description":"IPDebrief risk 40"}

```

---

## ANALYST NOTES

1. No Direct Threat Signals: Despite moderate risk score, IP shows no active malware, botnet, or scanning activity

2. Subnet Risk Factor: 63.67% abuse density in /24 subnet warrants monitoring even if this specific endpoint is clean

3. Ahrefs Association: Legitimate SEO company infrastructure; false positives likely if blocking all OVH IPs

4. Geographic Mismatch: Location signals require manual verification; RTT data suggests server may not be in reported location

5. No Email Infrastructure: SPF/DMARC absent - potential phishing source if email services activated

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.