176.31.139.6📋 Copy

IP Intelligence Briefing: 176.31.139.6/32

Date: 2026-06-10

---

**1. IP Profile**

• Risk Score: 40 (Moderate Risk)
• Provider: OVH (CloudCompute infrastructure)
• Ownership: Ahrefs Pte Ltd Dmytro (ASN 16276)
• Geolocation: France (Roubaix), inferred with 0.52 confidence.
• Threat Indicators: No active malicious indicators, blacklists, or campaigns.
• Network Role: Cloud-hosted server (OVH), no residential/mobile/mobile carrier.

---

**2. Observation History**

• Recent Activity (June 2026):

- Listed in 2 high-risk threat feeds (confidence 0.85).

- Classified as CloudCompute infrastructure (OVH).

- Subnet 176.31.139.6/24 flagged as high_abuse with 65.62% abuse density.

- Geolocation inferred as France (Roubaix), but accuracy is low (500km radius).

---

**3. Relationships**

• DNS Associations: Linked to `proxy-fr004-san6.ahrefs.net` (Ahrefs).
• Network Connections:

- Part of OVH network (ASN 16276).

- Subnet 176.31.139.6/24 with 31 sibling IPs (21 flagged as high-risk).

• Threat Context: Subnet has 21 high-risk neighbors, suggesting potential for lateral movement or shared infrastructure risks.

---

**4. Neighborhood Analysis**

• Subnet: 176.31.139.6/24
• Abuse Density: 65.62% (high_abuse classification).
• Neighbor Risk Distribution:

- 31 IPs in subnet (21 high-risk, 10 medium-risk).

- 2 active IPs, 21 threat siblings.

• Recommendation: Monitor subnet for suspicious activity; consider blocking traffic from this subnet if not required.

---

**5. Actionable Insights**

• SOC Prioritization:

- Investigate subnet 176.31.139.0/24 for potential lateral movement or shared malicious infrastructure.

- Validate Ahrefs' use of this IP (legitimate proxy service or compromised host?).

• Firewall Rules:

- Block or restrict traffic from 176.31.139.0/24 unless explicitly allowed.

- Monitor DNS queries to `proxy-fr004-san6.ahrefs.net` for anomalies.

• Threat Hunt:

- Correlate with other IPs in the subnet for potential campaign ties.

---

Conclusion: This IP is part of a high-risk subnet managed by OVH, linked to Ahrefs. While the IP itself shows no direct malicious activity, the subnet’s abuse density and high-risk neighbors warrant close monitoring. Prioritize isolating or restricting access to this subnet to mitigate potential threats.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.