167.114.139.69📋 Copy

## IP INTELLIGENCE BRIEFING: 167.114.139.69/32

Classification: Moderate Risk | Risk Score: 40

Ownership and Infrastructure

The IP belongs to OVH-CUST-281059679, assigned to Ahrefs Pte Ltd (ASN 16276, OVH network). The address is hosted on cloud computing infrastructure with a stated purpose of "Firewalled / No Services." DNS resolution points to proxy-ca000-san69.ahrefs.net, indicating association with the ahrefs.net domain ecosystem.

Geolocation Validation

Reported location: Montreal, QC, CA. Geolocation implausibility detected: Round-trip time (RTT) measurements indicate 24ms latency, while the minimum physically possible RTT for 5,597.4km distance is 111.9ms. This discrepancy suggests reported geographic coordinates do not match observed network characteristics.

Threat Profile

• Abuse Confidence: Not elevated
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Presence: Listed on 1 of 8 DNSBLs
• Campaign Correlation: None identified
• Persistence: Not persistently malicious

Neighborhood Context

The /24 subnet (167.114.139.0/24) shows high abuse density (0.7422):

• Total siblings: 256
• Active siblings: 207
• Threat siblings: 190
• Inherited risk score: 29

This indicates the IP resides within a heavily utilized OVH hosting environment with significant abuse activity among neighboring addresses.

Temporal Signals

21 observations recorded. Recent signals from 2026-06-15 confirm high_abuse subnet classification with 0.7422 abuse density. Ownership stability shows 0 ownership changes, suggesting consistent infrastructure assignment.

Recommended Actions

Given the moderate risk profile (40) and subnet abuse characteristics, defensive posture may be warranted:

Firewall Rules:

• `iptables -A INPUT -s 167.114.139.69 -j DROP`
• `nft add rule inet filter input ip saddr 167.114.139.69 drop`
• `nginx: deny 167.114.139.69;`
• Cloudflare WAF: Block IP with risk score 40
• AWS WAF: Add 167.114.139.69/32 to block list

Assessment Summary

IP 167.114.139.69 represents moderate risk (40) within a high-abuse subnet (0.7422). While no active threat indicators are present, the neighborhood context suggests elevated risk posture. No open services detected; infrastructure appears firewalled. Geographic validation anomalies warrant monitoring. Recommend correlating with other signals before implementing blocking measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.