142.44.220.0📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 142.44.220.0

Date: 2026-06-15

Classification: Moderate Risk (Score: 40/100)

---

## EXECUTIVE SUMMARY

IP 142.44.220.0 is a cloud-hosted address associated with OVH infrastructure under the Ahrefs Pte Ltd organization. The IP presents moderate risk with geolocation inconsistencies and operates within a high-abuse-density subnet. No active threat indicators or campaign associations were detected.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 142.44.220.0/24
• Infrastructure Type: Cloud Compute (OVH Hosting)
• Geolocation Claimed: Canada (QC) / Singapore (city)
• Geolocation Status: Invalid (plausible=false) — RTT analysis indicates 5,598km distance from claimed coordinates, inconsistent with claimed location

---

## THREAT ASSESSMENT

• Risk Score: 40/100 (Moderate Risk)
• Abuse Confidence: Not scored
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• Threat Feeds: None

---

## SUBNET ANALYSIS

Neighborhood: 142.44.220.0/24

• Subnet Classification: High Abuse
• Abuse Density: 0.6914 (69.14%)
• Total Siblings: 256
• Active Siblings: 173
• Threat Siblings: 177

Risk Distribution:

• High Risk: 0
• Medium Risk: 99
• Low Risk: 1

The subnet demonstrates elevated abuse activity consistent with shared cloud hosting infrastructure.

---

## NETWORK ROLE & SERVICES

• Primary Role: Cloud Hosting (OVH)
• Services: None detected (firewalled/no services)
• Open Ports: None
• DNS: proxy-ca006-san0.ahrefs.net (Ahrefs proxy service)
• Connection Type: Cloud infrastructure

---

## OBSERVATION HISTORY

Recent activity indicates:

• Abuse Density Classification: High abuse (0.6914)
• Threat Persistence: None observed
• Campaign Associations: None
• Correlated IPs: 0
• GeoValidation Issues: RTT violation detected (claimed 45.5075°N, -73.5887°W but actual RTT indicates Singapore proximity)

---

## RELATIONSHIP MAPPING

• Network Relationships: 41 total (primarily OVH-CUST-281059685 subnet)
• Same Network: Multiple associations within OVH customer network block

---

## RECOMMENDED ACTIONS

Due to moderate risk classification and high-abuse neighborhood context, implement blocking controls:

---

## ANALYST NOTES

1. Geolocation Discrepancy: Claimed Canada location contradicts RTT-based geolocation indicating Singapore proximity (5,598km distance). Verify against known Ahrefs proxy infrastructure.

2. Hosted Domain: DNS resolves to ahrs.net proxy service — consistent with Ahrefs SEO tools infrastructure.

3. Neighborhood Context: High abuse density (69.14%) suggests shared cloud environment may host multiple malicious actors. Consider broader subnet monitoring.

4. No Active Threats: No blacklisting, campaign associations, or known attacker indicators detected.

---

Status: Monitor — No immediate threat indicators present but high-abuse neighborhood warrants continued observation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.