167.114.139.38📋 Copy

IP Intelligence Briefing: 167.114.139.38

Date: 2026-06-13

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Provider: OVH (ASN 16276)
• Ownership: Registered to Ahrefs Pte Ltd (OVH-CUST-281059679)
• Geolocation: Montreal, Canada (CA) | Geo validation flags inconsistency (RTT of 27ms vs. 5597km distance).
• Network Role: CloudCompute Hosting (no active services detected).

---

**2. Threat & Abuse Context**

• Threat Indicators: No direct malicious activity observed.
• Subnet Abuse:

- 167.114.139.0/24 has high abuse density (0.7344) and 188 threat siblings.

- Inherited Risk: 29 (substantial risk from neighboring IPs).

• DNS:

- PTR hostname: `proxy-ca000-san38.ahrefs.net` (linked to Ahrefs).

- No email authentication records (SPF/DKIM).

---

**3. Temporal Observations**

• First Seen: 2026-06-13
• Observation History:

- Single observation with 0.75 confidence (stable signal).

- No persistent malicious activity or campaign correlations.

---

**4. Relationships & Neighbors**

• Network Connections:

- Linked to OVH-CUST-281059679 (same network).

- No external relationships (no subnets, domains, or certificates tied to this IP).

• Subnet Neighbors:

- 256 total IPs in 167.114.139.0/24.

- 204 active IPs, 188 flagged as threats.

- Risk Distribution: 99 medium-risk IPs, 1 low-risk IP.

---

**5. Security Actions**

• Firewall Recommendations:

- Block IP:

```bash

iptables -A INPUT -s 167.114.139.38 -j DROP

nft add rule inet filter input ip saddr 167.114.139.38 drop

```

- Cloud Providers:

- Cloudflare WAF: Block `ip.src eq 167.114.139.38`

- AWS WAF: Add `167.114.139.38/32` to rules.

---

**6. Analyst Notes**

• High Subnet Risk: Despite no direct threats, the IP resides in a subnet with high abuse density. Monitor for lateral movement or compromised neighbors.
• Geolocation Discrepancy: RTT inconsistency suggests potential spoofing or proxy activity. Verify with additional geolocation sources.
• Hosting Context: Associated with Ahrefs (web scraping/crawling services). Ensure compliance with their terms of service.

Next Steps:

• Investigate neighboring IPs in 167.114.139.0/24 for coordinated activity.
• Validate geolocation anomalies with passive DNS or TLS fingerprinting.
• Block the IP in security tools if it persists in traffic or correlates with suspicious behavior.

---

Source: IPDebrief Threat Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.