167.114.139.50📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 167.114.139.50/32

Classification: Moderate Risk (Score: 40/100)

Report Date: 2026-06-20

Analyst: IPDebrief Intelligence Platform

---

## EXECUTIVE SUMMARY

The target IP 167.114.139.50 is a cloud-hosted infrastructure endpoint operating within OVH's Montreal, Canada data center. The IP resolves to the ahrefs.net domain with no active services detected. While the individual IP shows moderate risk characteristics, it operates within a subnet exhibiting high abuse density (75.39%), suggesting potential for collateral malicious activity.

---

## OWNERSHIP & INFRASTRUCTURE

Provider: OVH (ASN: 16276)

Organization: Dmytro, Ahrefs Pte Ltd

Network Block: 167.114.139.0/24

Geolocation: Montreal, Quebec, Canada (CA)

Infrastructure Type: CloudCompute / Hosting

Registration RIR: ARIN

The IP is associated with OVH's cloud infrastructure and resolves to a proxy hostname (proxy-ca000-san50.ahrefs.net) under the ahrefs.net domain, indicating legitimate web infrastructure deployment.

---

## THREAT INDICATORS

Threat Status: No Active Threat Indicators

Known Attacker: No

Spam Source: No

Tor Exit Node: No

Blacklist Count: 0

DNSBL Listings: 1 of 8 total lists

Risk Assessment: The IP demonstrates no direct malicious indicators. However, the subnet classification as "high_abuse" with an abuse density score of 0.7539 warrants situational awareness.

---

## NETWORK BEHAVIOR

Service Status: Firewalled / No Services

Open Ports: None detected

TLS Certificate: None

HTTP Title: None

The target exhibits no active service exposure, consistent with backend infrastructure or internal hosting.

---

## SUBNET ANALYSIS: 167.114.139.0/24

Abuse Density: 0.7539 (High)

Subnet Classification: high_abuse

Total IPs: 256

Active Siblings: 211

Threat Siblings: 193

Risk Distribution in Subnet:

• High Risk: 0
• Medium Risk: 99
• Low Risk: 1

The /24 subnet demonstrates elevated abuse activity, with 193 threat-identified siblings. This contextual factor should influence blocking decisions despite the target IP's clean profile.

---

## OBSERVATION HISTORY

Total Observations: 23

Recent Activity: June 15-20, 2026

Threat Persistence: None

Ownership Changes: 0

Historical data indicates stable ownership with no malicious activity patterns detected over the observation period.

---

## RECOMMENDED ACTIONS

Firewall Rules:

• iptables: `iptables -A INPUT -s 167.114.139.50 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 167.114.139.50 drop`

WAF/CDN Integration:

• Cloudflare WAF: Block 167.114.139.50 with risk score 40
• AWS WAF: Block 167.114.139.50/32

Action Priority: LOW-MEDIUM

Justification: While the individual IP shows no direct threat indicators, the high-abuse subnet environment and moderate risk score (40) justify defensive blocking. Monitor for any service activation or behavioral changes.

---

Disclaimer: These intelligence recommendations are probabilistic and should be combined with other security signals before implementing blocking measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.