148.113.130.81📋 Copy

IP INTELLIGENCE BRIEFING: 148.113.130.81/32

EXECUTIVE SUMMARY

Target IP 148.113.130.81 is a Moderate Risk (40/100) cloud-hosted address belonging to OVH customer infrastructure. While no active threat indicators are present, the IP is associated with a high-abuse subnet and exhibits geolocation inconsistencies requiring validation.

OWNERSHIP & INFRASTRUCTURE

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• Netname: OVH-CUST-281059688
• CIDR Block: 148.113.130.0/24
• Infrastructure Type: CloudCompute / Hosting
• Network Status: Firewalled / No Open Services Detected
• DNS Resolution: proxy-ca009-san81.ahrefs.net

GEOLOCATION ANALYSIS

• Claimed Location: Singapore (geoSourceCount: 1)
• Validation Status: FAILED
• Anomaly: Traceroute data indicates 6,082km distance from source with 26ms RTT, which is physically impossible (minimum possible RTT: 121.6ms). This indicates geolocation spoofing or significant data quality issues.

THREAT ASSESSMENT

• Risk Score: 40 (Moderate)
• Abuse Confidence Score: Not calculated
• Blacklist Status: 0 blacklists
• DNSBL Listed: 1 of 8 lists
• Threat Feeds: No active threats
• Known Campaigns: None identified
• Campaign Likelihood: Not applicable

SUBNET ANALYSIS (148.113.130.0/24)

• Abuse Density: 0.6055 (HIGH ABUSE)
• Classification: high_abuse
• Total Siblings: 256
• Active Siblings: 168
• Threat Siblings: 155
• Inherited Risk: 24
• Risk Distribution: 100 medium-risk IPs, 0 high-risk, 0 low-risk

NETWORK RELATIONSHIPS

• DNS Associations: Multiple records for proxy-ca009-san81.ahrefs.net
• Network Relationships: Repeated associations with OVH-CUST-281059688 subnet

OBSERVATION HISTORY (21 signals)

• Recent Activity: 2026-06-20 through 2026-06-15
• DNS Signals: CAA records observed, domain ahrefs.net confirmed
• Scanning Activity: Port scans detected on 2026-06-15
• Threat Persistence: 0 days (not persistently malicious)
• Threat Observation Count: 1

RECOMMENDED SECURITY ACTIONS

Given the moderate risk score and high-abuse subnet classification, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 148.113.130.81 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 148.113.130.81 drop

```

Cloudflare WAF:

```json

{

"description": "Block 148.113.130.81 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 148.113.130.81"

}

}

```

AWS WAF:

```json

{

"Addresses": ["148.113.130.81/32"],

"Description": "IPDebrief risk 40"

}

```

INTELLEGEENCE NOTE

The geolocation discrepancy (claimed Singapore vs. RTT indicating ~6,000km distance) warrants validation. The high-abuse subnet context (60% abuse density, 155 threat siblings) suggests elevated risk of compromised or misused infrastructure in this /24 block. Consider blocking the entire 148.113.130.0/24 subnet if traffic patterns permit, or implement egress filtering rules.

FINAL RATING: MONITOR / BLOCK (context-dependent)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.