167.114.139.102📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 167.114.139.102/32

Classification: Moderate Risk / Cloud Infrastructure

Date: Current Analysis

---

## EXECUTIVE SUMMARY

IP 167.114.139.102 is a cloud-hosted address registered to OVH-CUST-281059679 under ASN 16276 (Dmytro, Ahrefs Pte Ltd). The address presents moderate risk (score 40) with no active threat indicators but operates within a high-abuse-density subnet (167.114.139.0/24). Geolocation validation anomalies detected.

---

## OWNERSHIP AND NETWORK CLASSIFICATION

• ASN: 16276 (Dmytro, Ahrefs Pte Ltd)
• Organization: OVH-CUST-281059679
• Infrastructure: Cloud compute (OVH hosting provider)
• Country: Canada (CA)
• Region: Quebec (QC)
• City: Montreal
• CIDR Block: 167.114.139.0/24
• Service Purpose: Firewalled / No Services

---

## THREAT INDICATORS ASSESSMENT

• Risk Score: 40 (Moderate)
• Abuse Confidence: Not scored
• Blacklist Status: 0 lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Association: None detected

---

## GEOLOCATION VALIDATION

Status: FLAGGED — RTT Discrepancy

• Claimed Location: Montreal, QC, CA (45.5063° N, -73.5794° W)
• Observed RTT: 31ms
• Minimum Possible RTT: 112ms (for 5597km distance)
• Validation Result: GEO_PLAUSIBLE = FALSE
• Conclusion: Distance calculation indicates location claim does not match network latency measurements.

---

## DNS AND RESOLUTION DATA

• PTR Hostnames: proxy-ca000-san102.ahrefs.net
• Forward Resolution: proxy-ca000-san102.ahrefs.net
• Domain: ahrefs.net
• Forward Confirmed: No
• Email Authentication: SPF/DMARC not configured

---

## NEIGHBORHOOD ANALYSIS

Subnet: 167.114.139.0/24

• Classification: HIGH ABUSE
• Abuse Density: 0.7188 (71.88%)
• Total Siblings: 256
• Active Siblings: 221
• Threat Siblings: 184

Risk Distribution in /24:

• High Risk: 0 addresses
• Medium Risk: 74 addresses
• Low Risk: 26 addresses

The subnet exhibits elevated abuse density, though the target IP itself lacks specific threat indicators.

---

## OBSERVATION HISTORY

Total Observations: 19 signals

Most Recent: 2026-06-20

Key Historical Signals:

• Network classification consistent: OVH hosting provider
• Geolocation signals show RTT/position violations
• Subnet abuse density classification: high_abuse
• No observed campaigns or correlated malicious activity

---

## SECURITY RECOMMENDATIONS

Risk Score: 40 — BLOCK RECOMMENDED

Recommended Actions by Platform:

Rationale: While the IP lacks direct threat indicators, the neighborhood abuse density (71.88%) and moderate risk score warrant defensive blocking. Consider monitoring for any escalation in activity.

---

## INTELLIGENCE ASSESSMENT

This IP appears to be legitimate cloud infrastructure for Ahrefs (SEO tooling company) but operates within an OVH subnet with significant abuse density. The geolocation validation failure suggests potential IP reputation laundering or misconfiguration. No evidence of direct malicious activity, but neighborhood context justifies precautionary blocking.

Recommendation: Block with monitoring. Review for any legitimate business requirements before implementing permanent block.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.