167.114.139.217📋 Copy

IP Intelligence Briefing: 167.114.139.217

Date: 2026-06-13

---

**1. Core Profile**

• Risk Score: 50 (Moderate Risk)
• Ownership:

- ASN: 16276 (OVH)

- Organization: Dmytro, Ahrefs Pte Ltd

- Netname: OVH-CUST-281059679

• Geolocation:

- Country: Canada (QC, Montreal)

- Accuracy Radius: 3,000 km

• Network Role:

- CloudCompute (OVH)

- Hosting: Yes

- Subnet: 167.114.139.0/24

---

**2. Threat Indicators**

• No Direct Malicious Activity:

- No indicators of spam, attacker, or Tor exit nodes.

- Zero threat feeds or campaigns linked.

• DNS & Services:

- PTR hostname: `proxy-ca000-san217.ahrefs.net`

- No open ports or TLS certificates detected.

---

**3. Network & Subnet Analysis**

• Subnet Abuse Density:

- 62.55% of sibling IPs (251 total) flagged as high-risk.

- 157 active threat siblings in the 167.114.139.0/24 subnet.

• Risk Inheritance:

- Inherited risk score: 25 (moderate) due to subnet context.

---

**4. Observation History**

• Recent Signals (2026-06-13):

- DNSSEC validation: Valid

- CAA records: Present

- Low confidence in geolocation (3000 km accuracy).

- No persistent malicious activity observed.

---

**5. Relationships & Connections**

• Linked Entities:

- Subnet: OVH-CUST-281059679

- Hostname: `proxy-ca000-san217.ahrefs.net` (ahrefs.net domain).

• No Known Campaigns or Correlated IPs.

---

**6. Recommended Actions**

• Firewall Blocking Rules:

- iptables: `iptables -A INPUT -s 167.114.139.217 -j DROP`

- nftables: `nft add rule inet filter input ip saddr 167.114.139.217 drop`

- Cloudflare WAF: Block IP with rule `ip.src eq 167.114.139.217`

• Monitor Subnet:

- High abuse density in 167.114.139.0/24 suggests broader subnet monitoring.

- Investigate neighboring IPs (e.g., 167.114.139.0–167.114.139.255) for potential threats.

---

**7. Summary**

The IP 167.114.139.217 is associated with a legitimate hosting provider (OVH) and appears to belong to Ahrefs, a known cybersecurity company. While the IP itself shows no direct malicious activity, its subnet (167.114.139.0/24) has a high abuse density (62.55%), with 157 threat siblings. SOC teams should:

1. Block the IP using provided firewall rules.

2. Monitor the entire subnet for anomalous activity.

3. Verify geolocation accuracy and check for potential spoofing.

Note: The IP’s risk score (50) and inherited subnet risk suggest caution, but no immediate action is required unless further indicators emerge.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.