168.100.149.79📋 Copy

## INTELLIGENCE BRIEFING: 168.100.149.79/32

Classification: Low Risk Infrastructure | Date: June 26, 2026

Analysis: SOC Intelligence Team

Executive Summary

IP 168.100.149.79 is a firewalled infrastructure node belonging to Ahrefs Pte Ltd (ASN 140577), registered in Virginia, USA. The IP carries a risk score of 25 and is classified as low risk. No active threat indicators were detected during the analysis window.

---

Ownership and Registration

• Organization: Ahrefs Pte Ltd administrator
• ASN: 140577
• Country: US (Virginia, Ashburn region)
• Network Role: Firewalled / No Services
• BGP Prefix: 168.144.0/20 (origin)

Technical Profile

• Risk Score: 25 (Low Risk)
• DNS Resolution: proxy-us001-san29.ahrefs.net (forward confirmed)
• Open Ports: None detected
• Service Status: No HTTP/HTTPS services exposed
• DNSBL Status: Listed on 1 of 8 threat feeds

Neighborhood Analysis (168.100.149.0/24)

• Total Subnet Size: 213 active siblings
• Risk Distribution: 0 high-risk, 18 medium-risk, 82 low-risk
• Abuse Density: 0.2817 (mixed classification)
• Threat Siblings: 60 IPs flagged within the /24
• Inherited Risk Score: 11

Historical Observations

• Total Signals: 22 observations tracked
• Recent Activity: June 26, 2026 (most recent)
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0
• Campaign Correlation: None detected
• Cert Matches: 0

Relationship Graph

• Network Associations: AHREFS-US (multiple links)
• DNS Associations: proxy-us001-san29.ahrefs.net (confirmed)
• Total Relationships: 34
• Campaign Correlated IPs: 0

---

Key Intelligence Indicators

✅ Low Risk Profile – Risk score 25, no active threat indicators

✅ Known Infrastructure – Ahrefs corporate network, established entity

✅ No Open Services – Firewalled configuration, no inbound services

✅ No Malicious Behavior – Zero threat observations, zero campaign matches

⚠️ RTT Anomaly – Geographic validation shows 27ms RTT vs. 126.2ms minimum possible distance, indicating potential multi-signal inference or routing anomaly

⚠️ Subnet Context – 60 threat siblings within /24 suggest elevated activity in broader subnet

---

Recommended Actions

• No immediate blocking required – IP classified as low risk with no active threat indicators
• Monitor subnet 168.100.149.0/24 – 60 threat siblings warrant network-level monitoring
• Validate geolocation – RTT anomaly suggests potential routing irregularity or data quality issue
• Log traffic patterns – Track connection frequency to establish baseline for this infrastructure node

---

Conclusion

168.100.149.79 represents legitimate Ahrefs infrastructure with no current malicious indicators. The IP should be permitted through security controls, with monitoring focused on the broader /24 subnet due to elevated sibling threat activity. No firewall rules or blocking actions recommended at this time.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.