148.113.130.55📋 Copy

# IP Intelligence Briefing: 148.113.130.55/32

## Executive Summary

IP address 148.113.130.55 is a cloud computing host within the OVH infrastructure (ASN 16276) allocated to "Dmytro, Ahrefs Pte Ltd." The asset presents moderate risk (score 50) with a moderate-high abuse density context within its /24 subnet. The IP is currently classified as "Firewalled / No Services" with no active open ports detected.

## Network Attribution & Infrastructure

• Provider: OVH (CloudCompute infrastructure)
• Organization: Dmytro, Ahrefs Pte Ltd (netname: OVH-CUST-281059688)
• CIDR Block: 148.113.130.0/24
• Geolocation: Canada (QC, Beauharnois) with 3000km accuracy radius
• PTR Record: proxy-ca009-san55.ahrefs.net (resolves to ahrefs.net)
• Infrastructure Type: Cloud hosting with hosting capabilities enabled
• BGP Prefix: 148.113.128.0/17

## Threat Assessment

• Risk Score: 50 (Moderate Risk)
• DNSBL Listings: 2 out of 8 total lists
• Known Campaigns: None detected
• Tor Exit/Proxy/VPN: Negative on all checks
• Threat Indicators: None in current threat feeds
• Abuse Confidence Score: Not reported

## Behavioral Context

• Service Status: No open ports detected; firewall appears to block all inbound traffic
• Route Stability: BGP routing is unstable (isRouteStable: false)
• Ownership Stability: No ownership changes observed
• Historical Signals: 23 observations collected, with DNSBL listings recorded on 2026-06-16

## Neighborhood Analysis

The /24 subnet (148.113.130.0/24) demonstrates elevated abuse context:

• Subnet Classification: high_abuse
• Abuse Density: 0.5195 (51.95% of IPs flagged)
• Active Siblings: 163 out of 256 total IPs
• Threat Siblings: 133 IPs with threat indicators
• Risk Distribution: 98 medium-risk, 2 low-risk, 0 high-risk neighbors
• Inherited Risk: 20 (from subnet context)

## Intelligence Narrative

IP 148.113.130.55 operates as a provisioned cloud host within the OVH ecosystem, associated with a reseller/infrastructure entity (Dmytro, Ahrefs Pte Ltd). The PTR hostname mapping to ahrefs.net suggests potential association with search engine marketing or web analytics infrastructure. Despite no active open ports, the IP maintains a moderate risk profile driven primarily by DNSBL presence and subnet-level abuse patterns.

The subnet context is significant: over 50% of addresses in 148.113.130.0/24 have been flagged for abuse, with 133 threat-sibling IPs. This elevated neighborhood risk warrants contextual correlation when evaluating traffic from this range.

## Recommended Actions

The following firewall rules are recommended for implementation:

## Monitoring Recommendations

1. Correlate subnet traffic: Monitor additional IPs in 148.113.130.0/24 for similar patterns

2. DNSBL monitoring: Track the 2 blacklist listings for changes

3. BGP monitoring: Watch for route changes on 148.113.128.0/17 prefix

4. Historical review: Review the 2026-06-16 DNSBL listing event for campaign indicators

---

*Intelligence generated from IPDebrief platform data. Rules are probabilistic and should be combined with other signals before operational deployment.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.