167.114.139.3📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 167.114.139.3/32

Classification: Moderate Risk | Cloud Infrastructure | OVH Hosting

Date: 2026-06-20

Prepared For: SOC Analyst

## Executive Summary

IP 167.114.139.3 is a cloud compute instance hosted on OVH infrastructure in Montreal, Canada (ASN 16276). The IP resolves to Ahrefs monitoring proxy infrastructure but exhibits geolocation inconsistencies and operates within a high-abuse subnet environment. Risk score is moderate (40/100) with no active threat indicators at the individual IP level.

## Infrastructure Profile

Ownership:

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network: OVH-CUST-281059679
• RIR: ARIN

Geolocation:

• Country: Canada (CA)
• Region: Quebec (QC)
• City: Montreal
• Accuracy Radius: 3000 km

Network Role:

• Infrastructure Type: CloudCompute
• Hosting Provider: OVH
• Service Purpose: Firewalled / No Services
• CDN/VPN/Proxy/Tor: No

## DNS Analysis

• PTR Hostname: proxy-ca000-san3.ahrefs.net
• Forward Resolution: proxy-ca000-san3.ahrefs.net
• Forward Confirmed: No
• Email Auth: No SPF/DMARC records

## Threat Intelligence

Current Threat Indicators:

• Abuse Confidence Score: Not applicable
• Is Known Attacker: No
• Is Spam Source: No
• Is Tor Exit: No
• Blacklist Count: 0
• DNSBL Listed: 0 of 8 total lists

Historical Observations (Last 20):

• Listed on 8 blacklist entries (max severity: high)
• Subnet abuse density: 0.7188 (high_abuse classification)
• Threat siblings in subnet: 192 of 256 (75% threat ratio)

## Neighborhood Analysis

Subnet: 167.114.139.0/24

• Classification: High Abuse
• Abuse Density: 0.75
• Inherited Risk: 30
• Active Siblings: 211 of 256
• Threat Siblings: 192

Sample Neighbor Risk Distribution:

• High: 0
• Medium: 99
• Low: 1

## Control Plane Analysis

• Origin ASN: 16276
• BGP Prefix: 167.114.128.0/18
• Route Stability: False
• DNSSEC Valid: False
• Has CAA: Yes

## Geographic Validation

CRITICAL ANOMALY DETECTED:

• Claimed Location: Montreal, QC, CA
• Inferred Distance: 5,597.4 km
• Observed RTT: 31.2ms
• Minimum Possible RTT for Distance: 111.9ms
• Status: INVALID (RTT violation indicates geolocation spoofing or data integrity issue)

## Actions & Recommendations

SOC Analyst Guidance:

1. Monitor but do not immediately block - Individual IP shows no active threat indicators, but subnet context is elevated

2. Flag for investigation - Geographic inconsistency (5,597km distance with 31ms RTT) warrants verification

3. Contextual assessment - Ahrefs infrastructure monitoring proxy; legitimate use case but elevated risk environment

Firewall Considerations:

• No immediate blocking recommended
• Monitor for outbound connection anomalies
• Subnet-level monitoring advised due to 75% threat sibling ratio

## Risk Assessment

Overall Risk: Moderate (40/100)

Risk Factors:

• ✓ Legitimate infrastructure ownership (Ahrefs)
• ✓ No active threat indicators
• ✓ No open services detected
• ✓ Not a known attacker/spam/Tor source

Risk Mitigating Factors:

• ✗ High-abuse subnet environment (75% threat ratio)
• ✗ Geolocation data integrity failure
• ✗ Listed on 8 blacklist entries historically
• ✗ Route instability detected

## Conclusion

IP 167.114.139.3 represents cloud infrastructure from Ahrefs' monitoring network with moderate risk characteristics. The geolocation validation failure and high-abuse subnet context suggest this IP may be repurposed or associated with compromised infrastructure within the same network segment. Recommend monitoring for anomalous behavior patterns rather than immediate blocking, but maintain awareness of the elevated subnet risk environment.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.