167.114.139.68📋 Copy

# IP Intelligence Briefing: 167.114.139.68/32

## Executive Summary

IP address 167.114.139.68 is classified as Moderate Risk (Score: 50) under OVH cloud infrastructure in Montreal, Canada. While the individual IP shows no direct threat indicators, it resides in a high-abuse-density subnet (0.7578), requiring contextual awareness during incident analysis.

---

## Ownership & Infrastructure

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Netname: OVH-CUST-281059679
• CIDR Block: 167.114.139.0/24
• Infrastructure Type: CloudCompute (OVH)
• Geolocation: Montreal, QC, CA

## Network Characteristics

• BGP Prefix: 167.114.128.0/18
• Route Stability: Not stable
• DNSSEC: Valid
• RPKI State: Not validated
• Service Purpose: Firewalled / No Services (no open ports detected)
• Hosted Domains: proxy-ca000-san68.ahrefs.net

## Threat Assessment

• Risk Score: 50 (Moderate)
• Abuse Confidence: Not scored
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Blacklist Count: 0
• DNSBL Listed: 2 of 8 lists
• Operator Score: 0.2174 (Minimal threat)

## DNS Analysis

• PTR Hostname: proxy-ca000-san68.ahrefs.net
• Forward Resolution: Confirmed
• Domain: ahrefs.net
• Email Auth: SPF/DMARC not configured
• CAA Records: Present

## Neighborhood Analysis

The /24 subnet (167.114.139.0/24) shows high abuse density with significant contextual risk:

• Total Siblings: 256
• Active Siblings: 211
• Threat Siblings: 194
• Abuse Density: 0.7578 (High)
• Inherited Risk: 30

Risk Distribution in Subnet:

• High Risk: 0
• Medium Risk: 99
• Low Risk: 1

## Historical Observations

• Total Observations: 23 signals
• Most Recent: 2026-06-20
• Abuse Density Classification: Consistently high_abuse across observations
• DNS Resolution: Consistently resolves to ahrefs.net infrastructure
• Threat Persistence: None observed (0 days)

## Relationships

• Network Associations: Multiple Same Network links to OVH-CUST-281059679
• DNS Associations: 15+ hostnames mapping to proxy-ca000-san68.ahrefs.net
• Campaign Correlation: No known campaigns associated
• Certificate Matches: 0

## Recommended Actions

No immediate blocking or firewall rules recommended. The IP shows no active malicious behavior despite moderate risk classification. Monitor for changes in DNS resolution or service emergence.

---

## SOC Analyst Notes

1. Contextual Risk: While individual indicators are benign, the subnet's high abuse density warrants awareness in incident correlation

2. Geolocation Validation: RTT measurements indicate geographic inconsistency (5597km distance vs. 112ms minimum possible), suggesting proxy or misconfigured routing

3. Infrastructure Type: OVH cloud hosting with firewalled service profile indicates legitimate infrastructure

4. Domain Association: ahrefs.net is a legitimate SEO analytics platform; this IP likely serves as infrastructure for legitimate operations

Threat Level: LOW-MODERATE (Infrastructure hosting risk, not direct threat)

Recommendation: Monitor; no immediate action required

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.