167.114.139.110📋 Copy

# IP Intelligence Briefing: 167.114.139.110/32

## Executive Summary

IP address 167.114.139.110 is a cloud-hosted infrastructure address operated by OVH Canada (ASN 16276) under customer OVH-CUST-281059679. The IP presents as moderate risk (Score: 40) but resides within a high-abuse-density subnet (167.114.139.0/24) with 186 active threat siblings out of 256 total addresses. While the IP itself shows no direct malicious indicators, neighborhood context and geolocation inconsistencies warrant monitoring.

## Ownership and Infrastructure

• Organization: Dmytro, Ahrefs Pte Ltd
• Network Name: OVH-CUST-281059679
• ASN: 16276 (OVH)
• Country: Canada (Quebec, Montreal)
• Infrastructure Type: CloudCompute
• Classification: Cloud Hosting / Firewall
• Registration: RIR ARIN

## Technical Profile

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence Score: Not calculated
• DNS Classification: proxy-ca000-san110.ahrefs.net (ahrefs.net)
• Open Ports: None detected
• Services: Firewalled / No Services exposed

## Threat Indicators

• Blacklist Count: 0
• DNSBL Listed: 1 of 8 lists
• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

## Geolocation Validation

Inconsistencies Detected:

• Claimed location: Montreal, QC, Canada (45.5063°N, -73.5794°W)
• Actual probe location: ~5,597 km from claimed position
• Minimum possible RTT: 112ms; Observed: 28-32ms
• Geo validation status: NOT PLAUSIBLE (RTT violation)
• 5 probe attempts recorded with consistent violations

This suggests the claimed geolocation is inaccurate or the IP is being used from an undisclosed location.

## Neighborhood Analysis

Subnet: 167.114.139.0/24

• Abuse Density: 0.7266 (High Abuse)
• Total Siblings: 256
• Active Siblings: 221 (86% utilization)
• Threat Siblings: 186 (73% of active addresses)
• Inherited Risk: 29

The subnet shows significant abuse concentration with 186 threat-sibling IPs, indicating this /24 block may be associated with compromised infrastructure or hosting services frequently exploited for malicious activity.

## Historical Observations (21 total)

• Consistent Cloud Classification: Cloud infrastructure confirmed across observations
• Persistent Abuse Density: High abuse classification (0.7266) observed since 2026-06-21
• Geolocation Instability: RTT violations consistently recorded (~30ms vs 112ms minimum possible)
• Operator Score: 0.2174 (Minimal)
• Threat Observation Count: 1
• Is Persistently Malicious: False

## Relationship Graph

• DNS Associations: proxy-ca000-san110.ahrefs.net (17 relationship entries)
• Network Associations: OVH-CUST-281059679 (12 relationship entries)
• Forward DNS: Confirms ahrefs.net domain association

## Recommended Actions

Based on the moderate risk score and neighborhood context:

1. Monitor Closely: Track for any changes in reputation or new threat indicators

2. Neighborhood Correlation: Review additional IPs in 167.114.139.0/24 subnet given 73% threat sibling ratio

3. Geolocation Verification: Investigate discrepancy between claimed and actual location

4. DNS Monitoring: Watch for DNS-based attacks targeting ahrefs.net infrastructure

5. Allow with Logging: Current risk level permits traffic but should be logged for SOC correlation

## Conclusion

IP 167.114.139.110 is a cloud-hosted address with no direct malicious indicators but operates within a high-abuse-density subnet. The geolocation validation failure and 186 threat siblings in the /24 block suggest this infrastructure may be part of a broader ecosystem of compromised or misused cloud resources. SOC teams should monitor for emerging threat indicators while maintaining awareness of neighborhood-level risks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.