148.113.130.6📋 Copy

# IP Intelligence Briefing: 148.113.130.6/32

## Executive Summary

Target IP 148.113.130.6 is a moderate-risk infrastructure endpoint associated with OVH cloud hosting, resolving to Ahrefs proxy infrastructure. The IP operates within a high-abuse subnet with elevated peer activity and exhibits geolocation inconsistencies. No active threat indicators detected at time of analysis.

## Host Identity & Ownership

• IP Address: 148.113.130.6/32
• Risk Score: 40 (Moderate Risk)
• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 148.113.130.0/24
• Infrastructure Type: CloudCompute/Hosting

## Network Classification

• Provider: OVH
• Infrastructure Type: CloudCompute
• Classification: Hosting
• Connection Type: No services detected (firewalled)
• Tor/Proxy/VPN: Negative indicators

## Geolocation Analysis

• Reported Country: Canada (CA)
• Geolocation Confidence: Low (geoPlausible: false)
• Anomaly: RTT violation detected—measured RTT of 27-35ms inconsistent with 6,082km distance from probe origin (minimum possible RTT: 121.6ms)
• Forward Resolution: proxy-ca009-san6.ahrefs.net

## Neighborhood Assessment

• Subnet: 148.113.130.0/24
• Abuse Density: 0.668 (High Abuse Classification)
• Active Siblings: 209 of 256 total
• Threat Siblings: 171
• Inherited Risk: 26

## Observed Signals

Analysis captured 22 signal observations. Recent infrastructure signals consistently classify the IP as cloud-hosting infrastructure. A single DNSBL listing recorded across 8 total lists. No active threat campaigns or known attacker associations detected.

## Relationships

Target IP shares network relationship with multiple OVH-CUST-281059688 network entries, indicating shared cloud infrastructure with other Ahrefs proxy endpoints.

## Recommended Security Actions

No automated recommendations generated due to moderate risk profile. However, the following firewall rules are available for deployment:

• iptables: `iptables -A INPUT -s 148.113.130.6 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 148.113.130.6 drop`
• nginx: `deny 148.113.130.6;`
• pfSense: `148.113.130.6/32`
• Cloudflare WAF: Block IP (expression: `ip.src eq 148.113.130.6`)
• AWS WAF: Add IP to block list (148.113.130.6/32)

## Assessment Notes

This IP operates within a high-abuse subnet environment. While the endpoint itself shows no active threat indicators, the elevated neighborhood risk score and geolocation inconsistencies warrant monitoring. The association with Ahrefs proxy infrastructure suggests potential use in web scraping, SEO analysis, or legitimate proxy services.

---

*Intelligence generated by IPDebrief. Rules should be combined with additional signals before deployment.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.