148.113.130.71📋 Copy

## IP Intelligence Briefing: 148.113.130.71

Classification: MODERATE RISK (Score: 50)

Status: Operational - No Active Threats Detected

Date: Current analysis based on observed data

---

**Ownership & Infrastructure**

• Provider: OVH SAS (ASN 16276)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 148.113.130.0/24
• Infrastructure Type: Cloud Computing / Hosting
• DNS Resolves: proxy-ca009-san71.ahrefs.net (ahrefs.net domain)

**Geolocation**

• Reported Location: Singapore, CA
• Validation Status: GEOLOCATION VIOLATION DETECTED
• RTT Discrepancy: 26ms observed vs. 121.6ms minimum required for claimed distance (6,082km)
• Note: Geolocation data inconsistent with network topology

**Threat Profile**

• Reputation: Moderate Risk
• Known Threats: NONE
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Lists: 2 of 8 total (listed)
• Operator Score: 0.2174 (Minimal)

**Network Context**

• Subnet Abuse Density: 0.6641 (HIGH ABUSE CLASSIFICATION)
• Threat Siblings: 170 of 256 IPs in subnet flagged as threats
• Inherited Risk Score: 26
• Control Plane: Unstable routing (isRouteStable: false)

**Observation History**

• Total Observations: 23
• Recent Activity:

- June 28, 2026: Threat indicators detected (AlienVault OTX)

- June 20, 2026: Subnet classified as high abuse; minimal operator score

• Temporal Analysis: No persistent malicious behavior detected (0 threat persistence days)

**Neighborhood Analysis (148.113.130.0/24)**

• Sampled Neighbors: 100
• Risk Distribution: 100 medium-risk IPs, 0 high-risk
• Active Siblings: 206 out of 256 total IPs

**Security Services**

• Open Ports: None detected
• HTTP/HTTPS: No services responding
• TLS/Certificates: None
• Status: Firewalled / No Services

**Recommendations for SOC Analysts**

1. MONITOR: No immediate blocking required, but maintain elevated monitoring due to high-abuse subnet context (66.41% abuse density)

2. CONTEXT AWARENESS: IP associated with ahrefs.net (SEO analytics infrastructure). Legitimate use case, but subnet shows elevated threat activity

3. GEOLOCATION DISCREPANCY: Singapore claim contradicted by RTT measurements. Do not rely on reported location for threat assessment

4. SUBNET CORRELATION: 170 threat siblings in same /24. Consider monitoring all 148.113.130.0/24 range for correlated activity

5. NO ACTION RECOMMENDED: Current IP shows no active malicious indicators, no open ports, and no known threat associations

---

Final Assessment: This IP represents legitimate OVH hosting infrastructure with moderate baseline risk due to subnet context. No immediate threat indicators present. Recommend standard monitoring with awareness of neighborhood threat patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.