176.31.139.13📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 176.31.139.13/32 | Classification: Moderate Risk | Date: 2026-06-28

---

## EXECUTIVE SUMMARY

IP address 176.31.139.13 operates as a cloud hosting infrastructure instance within the OVH network (ASN 16276) in Roubaix, France. The IP presents moderate risk (score: 45) with no active threat indicators or malicious campaigns associated. The address resolves to an Ahrefs service (proxy-fr004-san13.ahrefs.net), indicating legitimate business infrastructure. The subnet demonstrates elevated abuse density (0.75), with 24 of 32 sibling IPs flagged as threats.

---

## INFRASTRUCTURE PROFILE

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH SAS)
• Network Block: 176.31.0.0/16
• Geolocation: Roubaix, France (Europe/Paris timezone)
• Infrastructure Type: CloudCompute / Hosting
• Connection Type: Firewalled / No Services Open
• DNS Resolution: proxy-fr004-san13.ahrefs.net
• Email Authentication: No SPF, DMARC, or TXT records configured

---

## THREAT ASSESSMENT

• Risk Score: 45 (Moderate)
• Abuse Confidence: Not applicable
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Status: Listed on 2 DNSBLs (of 8 total)
• Campaign Correlation: None detected
• Threat Persistence: Low (0 threat observation days)

The IP has been observed 31 times over the monitoring period with consistent cloud infrastructure classification. No behavioral anomalies detected in recent observations.

---

## SUBNET ANALYSIS

Subnet: 176.31.139.13/24

• Total Siblings: 32
• Active Siblings: 23
• Threat Siblings: 24 (75% of active addresses)
• Risk Distribution: 0 High-risk, 12 Medium-risk, 19 Low-risk
• Abuse Density: 0.75 (High)

Notable High-Risk Siblings:

• 176.31.139.0 (Risk: 50)
• 176.31.139.2, 176.31.139.4, 176.31.139.6, 176.31.139.7, 176.31.139.11, 176.31.139.21 (Risk: 50)

---

## NETWORK RELATIONSHIPS

• Primary Network Association: OVH_282114229
• Relationship Count: 41
• Route Stability: Stable (0 route changes in 30 days)
• BGP Prefix: 176.31.0.0/16
• RPKI State: No validation data
• IRR Consistency: Match

---

## OBSERVATION HISTORY

Total Observations: 31

Most Recent: 2026-06-28 10:50:47 UTC

Key Signals:

• Cloud infrastructure classification (confidence: 0.90)
• OVH provider identification (confidence: 0.85)
• France geolocation validation (confidence: 0.60, avg RTT: 95ms)

---

## RECOMMENDED ACTIONS

Firewall Rules

iptables:

```bash

iptables -A INPUT -s 176.31.139.13 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 176.31.139.13 drop

```

WAF Rules

Cloudflare WAF:

```json

{"description":"Block 176.31.139.13 — IPDebrief risk score 45","action":"block","filter":{"expression":"ip.src eq 176.31.139.13"}}

```

AWS WAF:

```json

{"Addresses":["176.31.139.13/32"],"Description":"IPDebrief risk 45"}

```

nginx:

```nginx

deny 176.31.139.13;

```

---

## INTELLIGENCE NOTES

1. Infrastructure Legitimacy: Despite moderate risk scoring, the IP resolves to known Ahrefs infrastructure. Monitoring should be balanced against business context.

2. Subnet Risk: The 176.31.139.0/24 subnet exhibits high abuse density. Consider blocking the entire /24 if the single IP cannot be isolated.

3. No Active Services: No open ports detected, reducing immediate exploitation risk.

4. DNSBL Presence: Listed on 2 of 8 DNSBLs, indicating some reputation concerns.

---

Report Generated: IPDebrief Intelligence Platform

Classification: SOC-Ready Threat Intelligence

Validity: Current as of 2026-06-28

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.