148.113.130.36📋 Copy

# IP Intelligence Briefing: 148.113.130.36

## Executive Summary

IP 148.113.130.36 is a cloud infrastructure address associated with Ahrefs Pte Ltd (ASN 16276, OVH provider). While the IP itself shows moderate risk (score: 40), the /24 subnet exhibits high abuse density (0.6055) with 155 of 256 sibling IPs flagged as threats. The IP is heavily firewalled with no detected open ports or services.

## Infrastructure Profile

• Organization: Ahrefs Pte Ltd
• Network: 148.113.130.0/24 (OVH-CUST-281059688)
• ASN: 16276 (OVH)
• Infrastructure Type: Cloud Compute / Hosting
• DNS Resolution: proxy-ca009-san36.ahrefs.net
• Service Status: No open ports detected; infrastructure appears heavily firewalled

## Threat Indicators

• Risk Score: 40 (Moderate)
• Abuse Confidence: Not explicitly flagged
• Known Campaigns: None identified
• Blacklist Count: 0
• DNSBL Listed: 1 of 8 total lists
• Tor Exit/Attacker/Spam Source: No

## Geolocation Anomalies

Geolocation validation shows significant inconsistencies:

• Claimed Location: Singapore (based on DNS infrastructure)
• Registration Country: CA (Canada)
• RTT Validation: FAILED - 28ms RTT measured vs. 121.6ms minimum possible for 6082km distance
• Conclusion: Location data is implausible; IP likely not physically located in claimed region

## Neighborhood Analysis

The /24 subnet (148.113.130.0/24) shows concerning abuse patterns:

• Abuse Density: 0.6055 (high)
• Total Siblings: 256
• Active Siblings: 174
• Threat Siblings: 155
• Risk Distribution: 100 medium-risk IPs in subnet

## Observation History

19 observations recorded. Recent activity includes:

• DNS resolution to ahrefs.net domains
• No persistent threat indicators
• No malware or campaign associations detected
• Temporal analysis: 0 days of persistent malicious activity

## Security Recommendations

Based on risk profile and neighborhood context, the following defensive actions are recommended:

Recommended Firewall Rules:

• iptables: `iptables -A INPUT -s 148.113.130.36 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 148.113.130.36 drop`
• NGINX: `deny 148.113.130.36;`
• Cloudflare WAF: Block with expression `ip.src eq 148.113.130.36`

SOC Analyst Notes:

1. While this IP is associated with Ahrefs, the high abuse density in the parent subnet warrants blocking for defensive purposes

2. Geolocation inconsistencies suggest potential routing manipulation or misattribution

3. Consider monitoring for lateral movement to/from other IPs in 148.113.130.0/24 subnet

4. No immediate active threat indicators detected, but neighborhood context suggests elevated risk posture

---

*Data generated by IPDebrief intelligence platform. All indicators based on current threat data and should be validated against internal threat intelligence.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.