167.114.139.144📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 167.114.139.144/32

Classification: Moderate Risk - Cloud Infrastructure with High-Abuse Neighborhood

Date: 2026-06-17

Source: IPDebrief Threat Intelligence Platform

---

## EXECUTIVE SUMMARY

IP 167.114.139.144 is a cloud-hosted endpoint registered to Ahrefs Pte Ltd via OVH cloud infrastructure in Montreal, Quebec. The IP carries a risk score of 40 (Moderate Risk) and is associated with a high-abuse density subnet (0.7695 abuse density). The IP is not directly flagged as a known attacker, Tor exit node, or spam source, but the neighborhood context indicates elevated risk.

---

## OWNERSHIP AND INFRASTRUCTURE

The IP operates under cloud infrastructure with no open ports detected. DNS resolution maps to `proxy-ca000-san144.ahrefs.net`, indicating association with the Ahrefs domain infrastructure.

---

## THREAT INDICATORS

Critical Finding: Control plane data indicates the IP is listed on 1 of 8 DNS blacklist entries, suggesting some level of reputation concern despite no direct threat indicators.

---

## NEIGHBORHOOD ANALYSIS

The /24 subnet (167.114.139.0/24) exhibits elevated abuse characteristics:

Assessment: 197 out of 215 active siblings are flagged as threats. This indicates the subnet is actively used for malicious activity, though the target IP itself does not carry direct threat indicators.

---

## OBSERVATION HISTORY

Total observations: 21

Key Historical Signals:

• 2026-06-17 16:03: Subnet classified as "high_abuse" with 0.7695 abuse density
• 2026-06-17 15:58: Operator score: Minimal (0.2174) with DNSSEC validation
• 2026-06-17 15:57: Geovalidation failed - RTT discrepancy (26ms observed vs 112ms minimum possible for 5597km distance)
• 2026-06-13 23:31: DNS resolution confirmed for ahrefs.net domain

Geovalidation Alert: Traceroute indicates 5597.4km distance from probe location with 26ms RTT, violating the minimum possible RTT of 112ms. This suggests either inaccurate geolocation data or potential routing anomalies.

---

## RELATIONSHIP MAPPING

44 relationships identified:

• Multiple "Same Network" associations to OVH-CUST-281059679
• Cloud infrastructure network associations

No cross-network or organizational relationships beyond the primary hosting provider.

---

## RECOMMENDED ACTIONS

Risk-Based Action: Block or monitor based on neighborhood context.

Recommended Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 167.114.139.144 -j DROP

# nftables

nft add rule inet filter input ip saddr 167.114.139.144 drop

# nginx

deny 167.114.139.144;

# pfSense

167.114.139.144/32

# Cloudflare WAF

ip.src eq 167.114.139.144 → BLOCK

# AWS WAF

Addresses: 167.114.139.144/32

Description: IPDebrief risk 40

```

---

## SOC ANALYST NOTES

1. Context: This is a cloud hosting IP (OVH) with no direct threat indicators but high neighborhood risk.

2. Monitoring: Consider blocking the /24 subnet if traffic patterns suggest abuse, given 77% abuse density.

3. Legitimate Use: Ahrefs domain association suggests potential for legitimate use, but DNSBL listings warrant caution.

4. Geo Discrepancy: Investigate routing or geolocation anomalies if this IP is expected from Canada.

5. No Open Services: No open ports detected; firewall rules should focus on ingress traffic rather than port scanning.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.