142.44.220.179📋 Copy

# IP Intelligence Briefing: 142.44.220.179/32

## Executive Summary

IP address 142.44.220.179 is a moderate-risk (40/100) cloud infrastructure endpoint hosted by OVH under Ahrefs Pte Ltd. The IP operates within a subnet exhibiting high abuse density (63.28%), with 63% of 194 active siblings flagged as threats. Current risk posture is elevated due to DNS blacklist presence and persistent listing activity.

---

## Technical Profile

Network Assignment:

• Owner: Ahrefs Pte Ltd (OVH Customer 281059685)
• ASN: AS16276 (OVH SAS, France)
• CIDR Block: 142.44.220.0/24
• Registration: ARIN registry

Geolocation:

• Reported: Singapore (QC region)
• Confidence: Low (geoPlausible: false)
• RTT Anomaly: Observed 26ms RTT vs 112ms minimum possible for 5,598km distance from probe location
• RIR Classification: Non-bogon

DNS Resolution:

• PTR Record: proxy-ca006-san179.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: 1 hostname confirmed
• Email Authentication: SPF and DMARC not configured

---

## Threat Indicators

Current Risk Posture:

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence: Present but unquantified
• Blacklist Status: Listed on 1 of 8 DNSBLs
• Known Attacks: No active campaign matches detected

Observed Indicators:

• High-severity blacklist listings (8 total)
• ASN AS16276 flagged with threat indicators in recent observations (June 22, 2026)
• 1 threat observation recorded with high severity classification

---

## Neighborhood Analysis

Subnet Risk Profile (142.44.220.0/24):

• Total IPs: 256
• Active IPs: 194
• Threat IPs: 162 (83% of active addresses)
• Abuse Density: 0.6328 (High)
• Inherited Risk Score: 25

Risk Distribution:

• High Risk: 0
• Medium Risk: 92
• Low Risk: 8

The subnet demonstrates elevated threat activity, with the target IP inheriting significant contextual risk from neighborhood behavior.

---

## Operational Status

Network Role:

• Infrastructure Type: CloudCompute
• Hosting: Yes
• Services: None detected (firewalled/no open ports)
• Proxy/VPN/Tor: Negative

Control Plane:

• BGP Prefix: 142.44.128.0/17
• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not reported

---

## Historical Observations

Signal Activity: 24 observations recorded

• Most Recent: June 26, 2026
• Threat Persistence: 0 days (single observation)
• Ownership Changes: 0
• Notable Event: High-severity blacklist listing detected June 26, 2026 (confidence: 0.85)

---

## Recommended Actions

Immediate Mitigation:

1. Block at perimeter firewall: 142.44.220.179/32

2. Monitor subnet: 142.44.220.0/24 due to high abuse density

3. DNSBL verification: Confirm current blacklist status across remaining 7 lists

Firewall Rule Example:

```

iptables -A INPUT -s 142.44.220.179 -j DROP

```

Observation Priority:

• Monitor for new blacklist listings
• Track subnet-level threat activity escalation
• Verify hosting provider (OVH) abuse complaint channels

---

## Intelligence Assessment

This IP represents a moderate-risk cloud endpoint within a high-abuse subnet. While not confirmed malicious, the combination of DNS blacklist presence, subnet-level threat concentration, and unresolved geolocation anomalies warrants defensive blocking and continued monitoring. The IP's association with Ahrefs infrastructure suggests potential for both legitimate use and opportunistic abuse.

Classification: Moderate Risk - Monitor and Block

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.