148.113.130.62📋 Copy

THREAT INTELLIGENCE BRIEFING: 148.113.130.62/32

Executive Summary

IP 148.113.130.62 is classified as MODERATE RISK (40/100) and hosted on OVH infrastructure (AS16276). The address belongs to cloud hosting provider OVH-CUST-281059688 and presents elevated neighborhood-level risk within its /24 subnet.

Ownership & Network Classification

• Provider: OVH (AS16276)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 148.113.130.0/24
• Infrastructure Type: CloudCompute / Hosting
• Network Role: Firewalled / No Services Detected

Geolocation Analysis

Geolocation signals indicate claimed presence in Canada, but RTT analysis reveals significant discrepancies. The reported location (6,082 km distance from probe) shows an RTT of 31ms, which is physically implausible (minimum possible RTT: 121.6ms). Multiple geo sources report consensus, but geolocation plausibility flags indicate unreliable positioning.

Threat Intelligence

• Abuse Confidence: Not assessed
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Matches: None
• DNSBL Listings: 1 of 8 lists
• Threat Indicators: None detected
• Blacklist Count: 0

Neighborhood Risk Profile

The parent subnet 148.113.130.0/24 demonstrates HIGH ABUSE classification:

• Abuse Density: 51.17%
• Total Siblings: 256
• Active Siblings: 162
• Threat Siblings: 131
• Risk Distribution: 97 Medium, 3 Low, 0 High risk IPs sampled

DNS & Email Authentication

• PTR Hostname: proxy-ca009-san62.ahrefs.net
• Forward Resolution: ahrefs.net (1 hostname)
• Email Authentication: SPF not configured, DMARC not configured
• CAA Records: Present
• Forward Resolution Count: 1

Services Exposure

No open ports detected. TLS certificate, HTTP title, and server banner information unavailable. Infrastructure appears firewalled with no publicly accessible services.

Historical Trend

21 observations recorded through 2026-06-14. Most recent data shows consistent moderate-risk classification with subnet abuse density patterns. No significant risk escalation observed.

Recommended Security Actions

Based on risk profile (40/100), the following controls are recommended:

Firewall Rules:

• `iptables -A INPUT -s 148.113.130.62 -j DROP`
• `nft add rule inet filter input ip saddr 148.113.130.62 drop`
• `nginx: deny 148.113.130.62;`

WAF/Cloud Security:

• Cloudflare WAF: Block with expression `ip.src eq 148.113.130.62`
• AWS WAF: Block address 148.113.130.62/32

SOC Analyst Notes

This IP resides in a high-abuse density subnet with 131 identified threat siblings. While the address itself shows no direct threat indicators, the neighborhood context warrants defensive blocking. Consider evaluating for broader subnet-level restrictions if threat correlation with other 148.113.130.x addresses is observed.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.