142.44.220.118📋 Copy

# INTELLIGENCE BRIEFING: 142.44.220.118/32

Classification: Moderate Risk (Score: 40/100)

Date: 2026-06-26

Status: Active Threat Intelligence Signal

---

## EXECUTIVE SUMMARY

IP address 142.44.220.118 is hosted on OVH cloud infrastructure and resolves to Ahrefs.net domain endpoints. While the individual IP shows moderate risk, it operates within a high-abuse density subnet (142.44.220.0/24) containing 166 threat-identified siblings. No direct malicious indicators or known campaigns are associated with this IP.

---

## OWNERSHIP AND INFRASTRUCTURE

The IP belongs to the OVH-CUST-281059685 customer block, indicating shared cloud hosting infrastructure. The subnet contains 256 total sibling IPs with 175 currently active and 166 exhibiting threat indicators.

---

## GEOGRAPHICAL CLASSIFICATION

• Country: Canada (CA) / Singapore (discrepancy noted)
• Region: Quebec / Singapore
• Geolocation Confidence: Plausible (single source)
• DNS Resolutions: proxy-ca006-san118.ahrefs.net
• Reverse DNS: Confirmed via PTR record

---

## THREAT INTELLIGENCE

Current Risk Profile

• Overall Risk Score: 40 (Moderate)
• Abuse Confidence: Not quantified
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• Campaign Correlation: None detected

Neighborhood Context

• Subnet Abuse Density: 0.6484 (High)
• Inherited Risk Score: 25
• Threat Siblings: 166 out of 256 IPs
• Classification: High Abuse

---

## OBSERVATION HISTORY

Total Observations: 21 signals tracked

Key historical signals:

• 2026-06-26: Cloud infrastructure classification confirmed (OVH provider, hosting enabled)
• 2026-06-19: Subnet abuse density assessment (high_abuse classification)
• 2026-06-19: Network role assessment (cloud compute)

Temporal Analysis:

• Ownership changes: 0
• Threat observation count: 1
• Persistently malicious: No
• Route stability: False (route changes observed in 30-day window)

---

## NETWORK SERVICES

• Open Ports: None detected
• TLS Certificate: Not applicable (no services)
• HTTP Banner: None
• Service Classification: Firewalled / No Services

---

## RELATIONSHIP GRAPH

Total Relationships: 54 links identified

Primary relationship clusters:

• Same network blocks (OVH-CUST-281059685)
• Associated network infrastructure
• No external hostname or certificate relationships beyond Ahrefs.net domain

---

## RECOMMENDED ACTIONS

Firewall Rules (Immediate)

```bash

# iptables

iptables -A INPUT -s 142.44.220.118 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.220.118 drop

# Cloudflare WAF

ip.src eq 142.44.220.118 → BLOCK

# AWS WAF

Addresses: 142.44.220.118/32 → ACTION: BLOCK

```

Strategic Recommendations

1. Block individual IP: Risk score 40 warrants blocking at perimeter

2. Monitor subnet 142.44.220.0/24: High abuse density (64.8%) suggests broader risk

3. No escalation needed: No active campaigns or known attacker status

4. Review associated IPs: Consider blocking additional high-risk siblings if traffic patterns warrant

---

## ANALYST NOTES

The IP demonstrates characteristics typical of cloud-hosted infrastructure with moderate risk scoring. While no direct malicious activity has been observed, the subnet-level abuse density (166 threat siblings) suggests elevated risk in this address space. The Ahrefs.net domain resolution indicates legitimate SEO/marketing use case, but the shared hosting environment cannot be assumed clean.

Action Priority: MEDIUM

Block Recommendation: YES (based on risk score 40)

Escalation Required: No

---

*Report generated: 2026-06-26*

*Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.