142.44.220.161📋 Copy

# INTELLIGENCE BRIEFING: IP 142.44.220.161/32

## Executive Summary

IP address 142.44.220.161 is a moderate-risk cloud infrastructure endpoint associated with the Ahrefs Pte Ltd organization, hosted on OVH infrastructure. The IP resolves to a proxy hostname within the Ahrefs network and shows no active service signatures. While the IP itself shows no direct threat indicators, it resides within a subnet exhibiting high abuse density, warranting defensive monitoring.

## Technical Profile

• Risk Score: 40 (Moderate Risk)
• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 142.44.220.0/24
• Geolocation: Canada (CA), with Singapore data center indicators
• Infrastructure Type: Cloud Compute / Hosting
• DNS Resolution: proxy-ca006-san161.ahrefs.net (Ahrefs network)
• Service Status: Firewalled / No Services Detected

## Threat Indicators

• Abuse Confidence Score: Not Available
• Blacklist Status: 0 direct listings
• Campaign Association: None detected
• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False
• Control Plane: 1 out of 8 DNSBL lists (operator score: 0.2174 - Minimal)
• Route Stability: Unstable (route changes detected)

## Neighborhood Analysis (142.44.220.0/24)

• Abuse Density: 0.6836 (High Abuse Classification)
• Subnet Classification: high_abuse
• Active Siblings: 194 out of 256 total IPs
• Threat Siblings: 175 IPs flagged as threats
• Inherited Risk Score: 27
• Risk Distribution: High (0), Medium (36), Low (64)

## Historical Observations

Signal history reveals 18 observations with recent activity recorded on 2026-06-20. The IP consistently shows cloud hosting characteristics and OVH provider association. Geolocation data shows conflicting indicators (Canada registry vs. Singapore coordinates), suggesting complex hosting infrastructure.

## Defensive Recommendations

1. Monitor: Track outbound connections to this IP, particularly given the high-abuse subnet context

2. Block Consideration: Evaluate blocking inbound connections if the organization does not legitimately use Ahrefs infrastructure

3. Context: The IP resolves to Ahrefs proxy infrastructure - legitimate use cases include SEO analytics, web crawling, and market research tools

4. Subnet Awareness: 175 threat siblings within the /24 indicate potential lateral movement risks

## Intelligence Confidence

Medium-High - The IP profile is well-documented with consistent infrastructure associations. The high abuse density of the parent subnet provides contextual risk elevation despite the IP's clean direct threat profile.

---

*Report generated from IPDebrief intelligence data. SOC analysts should correlate with internal traffic logs and business context before taking enforcement action.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.