148.113.130.57📋 Copy

## IP Intelligence Briefing: 148.113.130.57

Classification: Moderate Risk (Score: 40/100)

Timestamp: Intelligence compiled from latest available data

Analysis Status: Complete

Ownership & Infrastructure

IP address 148.113.130.57 belongs to OVH SAS (ASN 16276) under customer block OVH-CUST-281059688. The infrastructure is classified as cloud compute/hosting within the 148.113.130.0/24 CIDR block. PTR hostname resolution indicates association with ahrefs.net domain (proxy-ca009-san57.ahrefs.net). No active services or open ports detected at the time of analysis.

Geolocation Anomaly

Geolocation data presents significant inconsistencies. The profile reports country code CA but coordinates suggest Singapore (6082km distance). RTT measurements (31ms) violate the minimum possible latency (121.6ms) for the claimed distance, indicating geolocation spoofing or data inconsistency. GeoPlausible validation returned false.

Threat Assessment

Current threat indicators show no active malicious activity. The IP is not classified as a Tor exit, known attacker, or spam source. No blacklist listings detected (0/0 DNSBL). However, the control plane indicates route instability with 0 route changes observed in the past 30 days.

Neighborhood Context

The /24 subnet (148.113.130.0/24) exhibits high abuse density (0.6055) with 155 of 256 sibling IPs flagged as threats. The subnet is classified as high_abuse with inherited risk score of 24. Of 100 sampled neighbors, 100 showed medium risk classification. This contextualizes 148.113.130.57 within a higher-abuse-density environment.

Historical Signals

Analysis of 21 historical observations reveals persistent patterns. Recent signals confirm high_abuse classification and operator score rated "Minimal." No observed threat persistence or ownership changes detected.

Recommendations for SOC

1. Monitor outbound traffic from this IP for anomalous patterns given neighborhood abuse density

2. Verify application legitimacy given ahrefs.net association (legitimate SEO/traffic analysis service)

3. Investigate geolocation spoofing indicators for potential evasion techniques

4. Consider enhanced monitoring during periods of increased subnet activity

Risk Rating: MODERATE — Cloud hosting IP in high-abuse-density subnet with geolocation inconsistencies but no active threat indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.