167.114.139.54📋 Copy

IP Intelligence Briefing: 167.114.139.54

Date: 2026-06-14

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Ownership:

- ASN: 16276 (OVH)

- Organization: Dmytro, Ahrefs Pte Ltd

- Subnet: 167.114.139.0/24

• Geolocation:

- Country: Canada (QC, Montreal)

- Geo Plausibility: False (RTT anomalies suggest geolocation inconsistency)

• Network Role:

- Hosting provider (OVH)

- Subnet classified as high_abuse (abuse density: 0.7422)

- No open ports, no TLS certificates, no HTTP services

---

**2. Threat Indicators**

• No direct malicious indicators (no blacklists, spam, or campaigns).
• Subnet Risk: 29 inherited risk points from high-abuse sibling IPs (190/256 IPs in subnet flagged).
• DNS: Resolves to `proxy-ca000-san54.ahrefs.net` (linked to Ahrefs).

---

**3. Observation History**

• Recent Activity (2026-06-14):

- DNS resolution for `ahrefs.net` (CAA records validated).

- Subnet abuse density increased to 0.7422 (from 0.6403 in June 2026).

- Network classified as "high_abuse" with 190 threat siblings.

---

**4. Relationships**

• Linked Entities:

- Subnet: `167.114.139.0/24` (OVH-CUST-281059679)

- Organization: Ahrefs Pte Ltd (OVH customer)

• No direct ties to known malicious campaigns or domains.

---

**5. Neighborhood Analysis**

• Subnet Overview:

- Total IPs: 256 (167.114.139.0/24)

- Active IPs: 207

- Threat IPs: 190 (74.22% abuse density)

• Risk Context:

- High-risk subnet with significant inherited risk.

- Siblings show mixed activity, but no direct malicious signals.

---

**6. Recommendations**

1. Monitor Subnet Traffic:

- Focus on 167.114.139.0/24 for unusual outbound connections or data exfiltration patterns.

2. Validate Geolocation:

- Investigate RTT anomalies (26ms vs. expected 112ms for 5,597km) to confirm IP legitimacy.

3. Check Ahrefs Infrastructure:

- Confirm if Ahrefs is using OVH infrastructure for legitimate services or potential abuse.

4. Implement Network Segmentation:

- Isolate high-risk subnets to limit lateral movement if compromised.

---

Conclusion:

167.114.139.54 is part of a high-abuse subnet managed by OVH, associated with Ahrefs. While no direct malicious activity is observed, the subnet’s risk profile warrants closer scrutiny. SOC teams should prioritize monitoring this subnet for anomalous behavior and validate geolocation inconsistencies.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.