167.114.139.21
IP Intelligence Briefing: 167.114.139.21/32
Date: 2026-06-13
---
**1. Risk Profile**
- Risk Score: 40 (Moderate Risk)
- Provider: OVH (ASN 16276)
- Ownership: Ahrefs Pte Ltd (OVH-CUST-281059679)
- Geolocation: Montreal, Canada (CA)
- Network Role: Cloud Compute (OVH infrastructure)
- Threat Indicators: No direct malicious activity detected.
---
**2. Observation History**
- Latest Observation (2026-06-13):
- Subnet abuse density: 0.7344 (High Abuse).
- Inherited risk: 29 (from subnet).
- Threat siblings: 188/256 IPs in the /24 subnet are flagged as threats.
- Behavioral Trends: No persistent malicious activity or campaign associations.
---
**3. Relationships & Network Context**
- Linked Entities:
- DNS: `proxy-ca000-san21.ahrefs.net` (Ahrefs Pte Ltd).
- Subnet: `167.114.139.0/24` (OVH customer network).
- Subnet Analysis:
- Abuse Density: 73.44% (High Abuse).
- Active Siblings: 204 IPs (188 flagged as threats).
- Risk Inheritance: 29% risk score from subnet.
---
**4. Neighborhood Data**
- Subnet: `167.114.139.0/24`
- Risk Distribution:
- High Risk: 0 IPs
- Medium Risk: 99 IPs
- Low Risk: 1 IP
- Neighbor Examples:
- `167.114.139.0` (Risk Score 40)
- `167.114.139.1` (Risk Score 40)
- `167.114.139.2` (Risk Score 40)
---
**5. Recommended Actions**
- Firewall Rules (Example):
- iptables: `iptables -A INPUT -s 167.114.139.21 -j DROP`
- Cloudflare WAF: Block IP with rule `ip.src eq 167.114.139.21`
- AWS WAF: Add `167.114.139.21/32` to a rule with description "IPDebrief risk 40".
- Monitoring:
- Monitor the `167.114.139.0/24` subnet for increased threat activity.
- Validate DNS records (`proxy-ca000-san21.ahrefs.net`) for potential spoofing.
---
Conclusion:
The IP is part of a high-abuse subnet linked to OVH and Ahrefs. While no direct malicious activity is detected, the subnet’s high threat density warrants cautious monitoring and network segmentation. Implement firewall rules to restrict traffic from this IP and investigate potential lateral movement risks.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Dmytro, Ahrefs Pte Ltd |
| ASN | AS16276 |
| Network Name | OVH-CUST-281059679 |
| CIDR Block | 167.114.139.0/24 |
| RIR | ARIN |
| Country | Singapore |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | proxy-ca000-san21.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-ca000-san21.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 28% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 12% | 2 | 2 |
| ownership | 19% | 2 | 2 |
| reputation | 30% | 1 | 3 |
| geolocation | 35% | 2 | 3 |
| Overall | 23% | 10 | 15 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-07 23:03:51 UTC |
| Last Seen | 2026-06-27 01:27:49 UTC |
| Profile Built | 2026-06-28 00:40:02 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 29 |
Full dossier details are available via our API.