167.114.139.251📋 Copy

## IP INTELLIGENCE BRIEFING

Target: 167.114.139.251/32

Classification: Moderate Risk Cloud Infrastructure

Report Date: Current

Analyst: IPDebrief Intelligence Team

---

EXECUTIVE SUMMARY

IP address 167.114.139.251 is a cloud-compute host registered to Ahrefs Pte Ltd within OVH SAS infrastructure (ASN 16276) located in Montreal, Quebec, Canada. The IP presents moderate risk (Score: 40) with no active malicious indicators. While the /24 subnet exhibits high abuse density (50.78%), this specific endpoint shows no direct threat activity. Recommended action: Monitor but no immediate blocking required.

---

OWNERSHIP & NETWORK CLASSIFICATION

The IP is part of Ahrefs' hosting infrastructure on OVH's cloud platform. No VPN, proxy, Tor, or CDN indicators detected. The network role is classified as hosting with no open services accessible.

---

DNS & FINGERPRINT ANALYSIS

• PTR Hostname: proxy-ca000-san251.ahrefs.net
• Forward Resolution: Not confirmed (forwardConfirmed: false)
• Domain: ahrefs.net
• Email Authentication: No SPF or DMARC records configured
• HTTP Services: None detected (firewalled)
• TLS Certificates: None observed

---

THREAT INDICATORS

No active threat feeds or known malicious campaigns associated with this IP.

---

NEIGHBORHOOD ANALYSIS

Subnet: 167.114.139.0/24

Abuse Density: 0.5078 (50.78%)

Classification: High Abuse

Subnet Statistics:

• Total siblings: 256
• Active siblings: 222
• Threat siblings: 130

Risk Distribution:

• High risk: 0 IPs
• Medium risk: 94 IPs
• Low risk: 6 IPs

The parent /24 subnet exhibits elevated abuse density. However, this specific IP (167.114.139.251) maintains a risk score of 40, indicating it is not among the high-risk endpoints within its neighborhood.

---

CONTROL PLANE & ROUTING

• Origin ASN: 16276
• BGP Prefix: 167.114.128.0/18
• AS Path: 57866 → 16276
• Route Stability: Stable (0 changes in 30 days)
• DNSSEC: Valid
• RPKI State: Not reported
• IRR Consistency: Not reported

Routing infrastructure is stable with no recent route modifications.

---

OBSERVATION HISTORY

Total Observations: 27

Most Recent: 2026-06-25T11:09:43 UTC

Key historical signals include:

• 2026-06-25: Consistent cloud hosting classification (OVH)
• 2026-06-25: Operator score: Minimal (0.2174)
• 2026-06-25: Subnet abuse density: 0.5078 (high_abuse)
• 2026-06-25: Geolocation: Montreal, QC, CA via AlienVault OTX

Temporal analysis indicates persistent cloud hosting classification with no recent ownership changes or malicious activity escalation.

---

RELATIONSHIP GRAPH

Total Relationships: 65

Primary Classification: Same Network (OVH-CUST-281059679)

The IP maintains relationships primarily within its assigned OVH customer network block. No certificate, hostname, or cross-organization relationships detected beyond the hosting infrastructure.

---

RECOMMENDED ACTIONS

1. Firewall Rules: No immediate blocking recommended. Allow monitoring only.

2. Traffic Analysis: If traffic observed, verify against Ahrefs service patterns.

3. Subnet Context: Monitor subnet 167.114.139.0/24 for abuse density changes.

4. Long-term: Add to watchlist for periodic review due to subnet's high abuse classification.

---

ANALYST NOTES

This IP belongs to a legitimate SEO tool provider (Ahrefs) hosted on major cloud infrastructure (OVH). The moderate risk score and lack of threat indicators suggest normal operational use. However, the elevated abuse density in the parent subnet warrants continued monitoring. No evidence of compromise or malicious activity was found during analysis.

Confidence Level: High

## ADDITIONAL INTELLIGENCE CONTEXT

CERTIFICATE & SSL ANALYSIS

No TLS certificates observed associated with this IP address. This is consistent with the firewalled status noted in the network role classification. No SSL pinning or certificate transparency log entries detected.

HEADER & FINGERPRINT ANALYSIS

• HTTP/2 Support: Not detected
• HSTS Enabled: False
• CSP Headers: Not present
• Referrer Policy: Not configured
• Permissions Policy: Not configured

These settings align with a non-public cloud compute endpoint without web-facing services.

TRACEROUTE PATH

Transit Networks: Comcast observed in path analysis. Path length: 18 hops.

EMAIL REPUTATION

Email reputation not applicable or scored for this endpoint. No sender score or email authentication configuration detected. This aligns with the absence of SPF/DMARC records for the associated domain.

TEMPORAL ANALYSIS

• Ownership Changes: 0 detected
• Average Ownership Duration: N/A
• Threat Persistence Days: 0
• Threat Observation Count: 1
• Is Persistently Malicious: False

The IP demonstrates stable cloud infrastructure classification with no historical ownership changes or persistent threat activity.

GEOVALIDATION STATUS

• GeoPlausible: False
• Distance (km): Not applicable
• Minimum RTT (ms): Not applicable
• Probe Count: 0
• Violation Status: None recorded

Geovalidation limitations are consistent with cloud infrastructure where physical location data is abstracted.

---

SOC INTEGRATION RECOMMENDATIONS

#### SIEM Rule Configuration

```yaml

Rule Name: IP-167-114-139-251-Monitor

Action: Log and Alert (Low Priority)

Conditions:

- src_ip == 167.114.139.251

- dst_port NOT IN [80, 443, 8080]

- session_duration > 300

Alert: "Unusual connection pattern from Ahrefs cloud host"

```

#### IDS/IPS Signatures

No active threat signatures required. If traffic is observed:

• Allow: HTTPS (443), SSH (22), standard cloud protocols
• Monitor: Any non-standard outbound connections
• Block: Only if correlated with other threat indicators

#### Ticket Escalation Criteria

Escalate to Threat Intelligence Team if:

1. Traffic volume exceeds baseline by >300%

2. Multiple failed authentication attempts observed

3. Subnet abuse density increases >5% in 24 hours

4. IP appears in new threat feeds within 48 hours

---

FALSE POSITIVE CONSIDERATIONS

---

FINAL ASSESSMENT

Threat Level: MODERATE RISK

Immediate Action: Monitor

Blocking Required: NO

Whitelisting Consideration: YES (for legitimate Ahrefs services)

This endpoint represents legitimate cloud hosting infrastructure with no observed malicious activity. The moderate risk score is primarily influenced by the parent subnet's abuse density rather than individual IP threat activity. SOC teams may proceed with standard monitoring protocols.

Report Classification: DEFENSIVE INTELLIGENCE

Data Source: IPDebrief Intelligence Platform

Analysis Confidence: HIGH

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.