167.114.139.242📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 167.114.139.242/32

Classification: MODERATE RISK

Date: Current

---

## EXECUTIVE SUMMARY

IP 167.114.139.242 is a cloud-based infrastructure address assigned to OVH hosting (ASN 16276) with moderate risk indicators. The IP demonstrates geolocation inconsistencies and is associated with the ahrefs.net domain infrastructure. The /24 subnet exhibits elevated abuse density (0.5078), with 130 of 256 active sibling IPs flagged as threat sources.

---

## OWNERSHIP & INFRASTRUCTURE

• Organization: Dmytro, Ahrefs Pte Ltd
• AS Number: 16276 (OVH)
• Network Block: 167.114.139.0/24
• Infrastructure Type: CloudCompute, Hosting
• Geolocation: Montreal, QC, CA (reported)
• Registration: RIR: ARIN

Note: Geolocation validation flagged with 5,597km distance discrepancy and 28ms RTT, which is physically implausible for Canadian location (minimum possible RTT: 112ms). GeoPlausible: false.

---

## THREAT INDICATORS

• Risk Score: 40/100 (Moderate Risk)
• Blacklist Status: 1 of 8 DNS blacklists
• Threat Feeds: None reported
• Known Campaigns: None
• Tor Exit/Attacker/Spam Source: Negative
• Operator Score: 0.2174 (Minimal)

Control Plane:

• Route stability: False (route changes: 0 in 30 days)
• DNSSEC: Valid
• RPKI State: Not assessed
• IRR Consistency: Not assessed

---

## DNS & REPUTATION

• PTR Hostname: proxy-ca000-san242.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed (1 hostname)
• Email Auth: No SPF, No DMARC records
• TXT Records: None
• Certificate Authority (CAA): Present

---

## NETWORK SERVICES

• Open Ports: None detected
• HTTP/TLS: No services running
• Server Banner: None
• Classification: Firewalled / No Services

---

## OBSERVATION HISTORY

Total observations: 24 signals over monitoring period

Recent Activity:

• 2026-06-27 19:34 UTC: Operator score 0.087 (Minimal), confidence 0.30
• 2026-06-27 19:34 UTC: Multi-dimension profile assessment (6/6 dimensions covered), confidence 0.24
• 2026-06-26 10:14 UTC: Geolocation signal: Canada (CA), confidence 0.18, accuracy radius 3,000km
• 2026-06-26 10:13 UTC: Operator score 0.087 (Minimal), confidence 0.30

Temporal Analysis:

• Ownership changes: 0
• Threat persistence: 0 days
• Is persistently malicious: False
• Threat observation count: 1

---

## NEIGHBORHOOD ANALYSIS

Subnet: 167.114.139.0/24

Abuse Density: 0.5078 (High Abuse Classification)

Total Siblings: 256

Active Siblings: 224

Threat Siblings: 130

Inherited Risk: 20

Sampled Neighbor Risk Distribution:

• High Risk: 0/100
• Medium Risk: 86/100
• Low Risk: 14/100

---

## RELATIONSHIP GRAPH

Total relationships: 52

Key Connections:

• Network: OVH-CUST-281059679 (Multiple same-network entries)
• Domain: ahrefs.net
• Organization: Dmytro, Ahrefs Pte Ltd

---

## RECOMMENDED ACTIONS

Based on risk profile and threat indicators:

1. Traffic Filtering:

- Consider blocking inbound connections from this IP

- Apply firewall rules for iptables, nftables, or pfSense

2. DNS Filtering:

- Block DNS queries to proxy-ca000-san242.ahrefs.net if not business-required

- Monitor for DNS tunneling attempts

3. Monitoring:

- Add to SIEM correlation rules for outbound connections

- Monitor for scanning activity from associated /24 subnet

4. Email Security:

- Block emails from this IP (no SPF/DMARC configured)

---

## ASSESSMENT

This IP represents moderate risk with no active threat indicators. The primary concern is the high-abuse-density neighborhood (0.5078) and geolocation inconsistencies that suggest potential spoofing or misconfiguration. The association with ahrefs.net infrastructure and OVH hosting indicates legitimate use case, but the subnet-level abuse rate warrants monitoring. Recommend continued observation and consider blocking if connection attempts are observed from external sources.

Overall Recommendation: Monitor / Block Based on Context

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.