176.31.139.20📋 Copy

# IP Intelligence Briefing: 176.31.139.20/32

## Executive Summary

IP address 176.31.139.20 is a cloud hosting infrastructure endpoint operated by OVH in France. The IP presents moderate risk (score 40) with elevated neighborhood-level abuse indicators. The address is associated with the legitimate domain ahrefs.net but resides within a subnet characterized by high abuse density (0.75).

## Infrastructure Profile

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH)
• Location: Roubaix, Hauts-de-France, France
• Infrastructure Type: Cloud Compute (OVH hosting provider)
• Network Classification: Firewalled / No Services
• DNS Hostname: proxy-fr004-san20.ahrefs.net

## Threat Indicators

• Risk Score: 40 (Moderate Risk)
• Blacklist Status: Listed on 1 of 8 DNSBLs
• Known Threats: None identified
• Abuse Confidence: No specific threat indicators
• Control Plane Status: Route instability detected; DNSSEC valid

## Neighborhood Analysis

The /24 subnet (176.31.139.0/24) exhibits significant abuse indicators:

• Abuse Density: 0.75 (High)
• Total Siblings: 32
• Active Siblings: 23
• Threat Siblings: 24
• Risk Distribution: 11 medium, 20 low risk scores across neighbors

Notable high-risk neighbors in the same subnet include:

• 176.31.139.0 (Risk: 50)
• 176.31.139.2 (Risk: 50)
• 176.31.139.6 (Risk: 50)
• 176.31.139.7 (Risk: 50)
• 176.31.139.11 (Risk: 50)

## Historical Observations

Signal history indicates 18 observations recorded. Recent activity confirms:

• Persistent cloud infrastructure classification
• Consistent geolocation inference (France)
• Stable ownership under OVH
• No persistent malicious behavior detected
• Minimal operator score (0.2174)

## Relationships

• DNS Association: proxy-fr004-san20.ahrefs.net (primary hostname)
• Network Affiliation: OVH_282114229 (multiple relationship entries)

## SOC Recommendations

1. Monitor Closely: While the target IP shows no direct malicious indicators, the high-abuse neighborhood warrants ongoing monitoring

2. Contextual Assessment: Legitimate hosting infrastructure under OVH; evaluate based on observed traffic patterns rather than IP reputation alone

3. Subnet-Wide Consideration: 75% abuse density in the /24 suggests collateral traffic filtering may benefit security operations

4. Action: No immediate blocking recommended; maintain logging and alerting for anomalous behavior patterns

---

*Intelligence generated from IPDebrief platform data. Analysis timestamp: 2026-06-20.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.