148.113.130.34📋 Copy

INTELLIGENCE BRIEFING: IP 148.113.130.34

EXECUTIVE SUMMARY

IP address 148.113.130.34 presents a moderate risk profile (Score: 40/100) with no active threat indicators. The address is hosted on OVH Cloud infrastructure (ASN 16276) associated with Ahrefs Pte Ltd. While the IP shows no direct malicious activity, the /24 subnet demonstrates elevated abuse density (0.6133) with 157 threat siblings out of 256 total IPs, indicating a high-abuse classification environment.

OWNERSHIP & NETWORK CLASSIFICATION

• ASN: 16276
• Organization: Dmytro, Ahrefs Pte Ltd
• Netblock: OVH-CUST-281059688 (148.113.130.0/24)
• Infrastructure Type: CloudCompute (OVH)
• Service Purpose: Firewalled / No Services
• Network Role: Cloud Hosting Provider

GEOLOCATION CONTEXT

• Country Code: CA (Canada)
• City: Singapore (geolocation inconsistency detected)
• Geolocation Confidence: Inconsistent sources; geoPlausible flag false
• Traceroute: 18 hops via Comcast transit
• RTT: 33.6ms (last hop)

THREAT ASSESSMENT

• Risk Score: 40 (Moderate Risk)
• Blacklist Status: 0 blacklists; 1 DNSBL listing out of 8 total lists
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Correlation: No known campaigns; 0 cert matches; 0 banner matches
• Threat Persistence: 0 days; not persistently malicious
• Active Threat Indicators: None detected

NETWORK SERVICES & DNS

• Open Ports: None detected
• DNS Records: proxy-ca009-san34.ahrefs.net (PTR hostname)
• Forward Resolution: Confirmed for ahrefs.net domain
• Email Authentication: No SPF or DMARC records configured
• TLS/HTTP Services: None detected (firewalled)
• DNSSEC: Valid

CONTROL PLANE ANALYSIS

• BGP Prefix: 148.113.128.0/17
• Route Stability: Unstable (isRouteStable: false)
• Route Changes (30d): 0
• RPKI State: Not available
• Operator Score: 0.2174 (Minimal)
• IRR Consistency: Not evaluated

HISTORICAL OBSERVATIONS (18 total signals)

• Latest Observation: 2026-06-16 11:46 UTC
• Abuse Density Trend: 0.6133 (high_abuse classification)
• Geolocation Signals: Inconsistent; one observation shows CA with coordinates (56.13, -106.35)
• Ownership Changes: 0; stable ownership
• Threat Persistence: 0 days observed
• Signal Count: 1 threat observation

RELATIONSHIP NETWORK

• Same Network Associations: 10 entries linked to OVH-CUST-281059688
• DNS Associations: 5 entries mapping to proxy-ca009-san34.ahrefs.net
• Correlated Entities: No additional IP relationships identified

NEIGHBORHOOD ANALYSIS (148.113.130.0/24)

• Abuse Density: 0.6133 (high_abuse classification)
• Total Subnet IPs: 256
• Active Siblings: 185
• Threat Siblings: 157
• Neighbor Risk Distribution:

- High Risk: 0

- Medium Risk: 100

- Low Risk: 0

• Inherited Risk: 24 (from neighborhood context)
• Sample Neighbor Risk Scores: 40/100 (consistent across sampled IPs)

RECOMMENDED ACTIONS

• Monitor: Track for service activity emergence (currently firewalled)
• Contextual Awareness: Recognize as cloud hosting infrastructure within high-abuse subnet
• Traffic Analysis: Review for any outbound connections from associated hostnames
• Geolocation Validation: Investigate CA vs. Singapore geolocation discrepancy
• Email Reputation: Note lack of SPF/DMARC for associated domains

ASSESSMENT SUMMARY

The IP address represents cloud infrastructure with no direct evidence of malicious activity. However, the high-abuse neighborhood classification warrants monitoring. The subnet's elevated threat density (61.33%) suggests potential for related abuse activity from adjacent IPs. No immediate blocking is recommended; instead, maintain contextual awareness and monitor for service activity or indicator emergence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.