167.114.139.177📋 Copy

# IP Intelligence Briefing: 167.114.139.177

## Executive Summary

IP 167.114.139.177 is a moderate-risk address (score: 40/100) hosted by OVH in Montreal, Canada. The IP resolves to the Ahrefs domain infrastructure with a proxy hostname pattern. Despite limited direct threat indicators, the subnet exhibits elevated abuse density (0.7188) with 184 out of 256 sibling IPs flagged as threats.

## Ownership and Network Classification

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network: OVH-CUST-281059679 (167.114.139.0/24)
• Infrastructure Type: Hosting provider with cloud compute infrastructure
• Registration: ARIN registry

## Geolocation Assessment

• Reported Location: Montreal, Quebec, Canada (CA)
• Geolocation Validation: Invalid (GEOPLAUSIBLE: false)
• Anomaly: Distance of 5,597.4km from probe origin violates minimum RTT expectations (actual: 27ms, minimum possible: 112ms)
• Implication: Geolocation data may be spoofed or misreported

## DNS Analysis

• PTR Hostname: proxy-ca000-san177.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed
• DNSBL Listings: 1 of 8 total lists
• Email Authentication: No SPF or DMARC records configured

## Service and Network Role

• Open Ports: None detected (firewalled/no services)
• TLS Certificates: None
• Infrastructure Classification: Hosting provider (isHosting: true)
• Cloud Services: Not flagged as CDN, VPN, proxy, or Tor exit node

## Threat Intelligence Indicators

• Risk Score: 40 (Moderate)
• Abuse Confidence: Null (insufficient data)
• Known Campaigns: None identified
• Campaign Likelihood: Null
• Threat Feeds: No active matches
• DNSBL Status: Listed on 1 of 8 monitoring lists

## Subnet Neighborhood Analysis

• Subnet: 167.114.139.0/24
• Abuse Density: 0.7188 (High abuse classification)
• Active Siblings: 219 of 256 IPs
• Threat Siblings: 184 IPs flagged as threats
• Inherited Risk Score: 28
• Risk Distribution: 100 medium-risk neighbors, 0 high/low risk

## Historical Observations

• Total Observations: 18 signals recorded
• Recent Activity: Provider and abuse density signals observed June 2026
• Signal Confidence: Moderate to high (0.60-0.90)
• Threat Persistence: Not persistently malicious

## Relationship Graph

• Total Relationships: 48 connections
• Primary Associations: Network-level connections to OVH-CUST-281059679
• Network Affiliation: Consistent with hosting infrastructure

## Recommended Actions

• Monitoring Priority: Medium - subnet exhibits high abuse density
• Blocking Consideration: Monitor for outbound connections; subnet context suggests potential for compromised hosts
• Geolocation Verification: Implement location-based anomaly detection due to validation failures
• DNSBL Monitoring: Track blacklist status changes

## Intelligence Narrative

IP 167.114.139.177 operates within OVH's hosting infrastructure in Montreal, associated with Ahrefs domain services. The address presents moderate risk through its subnet environment rather than direct malicious indicators. The 167.114.139.0/24 subnet shows elevated abuse density with 71.88% of sibling IPs flagged as threats, suggesting potential infrastructure compromise or shared hosting abuse vectors. Geolocation data validation failures indicate possible spoofing or misconfiguration. Despite no current direct threat indicators, the high-threat neighborhood context warrants continued monitoring. The IP's firewalled status with no open ports suggests it may serve as a management or proxy endpoint for the Ahrefs infrastructure rather than an active service-facing host.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.