148.113.130.49📋 Copy

IP Intelligence Briefing: 148.113.130.49

Date: 2026-06-15

---

**1. Core Profile**

• Risk Score: 25 (Low Risk)
• Ownership:

- ISP: OVH (ASN 16276)

- Organization: Dmytro, Ahrefs Pte Ltd

- Subnet: 148.113.130.0/24

• Geolocation:

- Country: Canada (CA)

- City: Singapore

- Geo Validity: `geoPlausible: false` (RTT anomaly: 27ms vs. expected 121.6ms for 6082km)

• Network Role:

- Type: CloudCompute (OVH-hosted)

- Services: No open ports, no TLS certs, no HTTP banners

• Threat Indicators:

- No malicious indicators, spam, or known attacker associations.

---

**2. Observation History**

• Recent Activity:

- Last observed on 2026-06-15 with minimal risk signals (0.2174 operator score).

- DNS records resolve to `proxy-ca009-san49.ahrefs.net` (linked to Ahrefs).

• Trends:

- No persistent malicious activity; threat observation count = 1.

- Subnet abuse density: 0.4157 (mixed classification, 106 threat siblings in /24).

---

**3. Relationships**

• Connected Entities:

- Linked to OVH-CUST-281059688 (same network).

- DNS: `ahrefs.net` (no email auth records, no SPF/DKIM).

• Network Context:

- Subnet 148.113.130.0/24 has 255 total IPs, with 144 active and 106 flagged as threats.

---

**4. Neighborhood Analysis**

• Subnet Risk:

- Abuse Density: 41.57% (moderate risk).

- High-Risk Neighbors: 60 IPs (riskScore ≥ 40).

- Low-Risk Neighbors: 40 IPs (riskScore ≤ 25).

• Notable Neighbors:

- `148.113.130.0` (riskScore 25), `148.113.130.3` (riskScore 40).

---

**5. Actionable Insights**

• No Immediate Threat:

- The IP itself is low risk and associated with a legitimate cloud provider (OVH).

• Monitor Subnet:

- The /24 subnet has a moderate abuse density (41.57%), suggesting potential for lateral movement or compromised hosts.

• Geolocation Discrepancy:

- RTT inconsistency (27ms vs. 6082km distance) may indicate misconfigured DNS or spoofing.

• DNS Security:

- Ahrefs’ DNS lacks email authentication (SPF/DKIM). Ensure downstream systems validate DNSSEC and CAA records.

---

Recommendation:

• Monitor subnet for unusual traffic patterns or new threat siblings.
• Validate geolocation via alternative methods (e.g., traceroute, WHOIS).
• Enhance DNS security for Ahrefs’ domain to mitigate spoofing risks.

Source: IPDebrief Threat Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.