142.44.220.192📋 Copy

## IP Intelligence Briefing: 142.44.220.192/32

Classification: Moderate Risk Cloud Infrastructure

Date: June 2026

Analyst: IPDebrief Intelligence Team

---

Executive Summary

IP address 142.44.220.192 is a cloud infrastructure endpoint operated by Dmytro, Ahrefs Pte Ltd via OVH hosting provider (ASN 16276). The IP demonstrates moderate risk characteristics (Risk Score: 40) with concerning subnet-level abuse patterns. Geolocation validation reveals significant inconsistencies requiring investigation. No active threat indicators were observed, but the high-abuse subnet classification warrants enhanced monitoring.

---

Network Attribution

• Organization: Dmytro, Ahrefs Pte Ltd
• Provider: OVH (ASN 16276)
• CIDR Block: 142.44.220.0/24
• Infrastructure Type: Cloud Compute / Hosting
• Network Classification: Cloud, Hosting-enabled

---

Geolocation Analysis

Critical Finding: Geolocation data shows implausible inconsistencies requiring validation.

• Claimed Location: Singapore (QC region)
• Reported Country Code: CA (Canada)
• Distance Violation: RTT measurements indicate 5,597.9km distance with 27ms latency, violating minimum physics (112ms minimum possible RTT for this distance)
• Validation Status: GEO_VALIDATION_FAILED
• Probe Count: 5 probes across 27 historical observations

This discrepancy suggests either misconfigured reporting or potential spoofing activity.

---

Subnet Risk Profile

The /24 subnet (142.44.220.0/24) demonstrates elevated abuse characteristics:

• Abuse Density: 69.53% (High Abuse Classification)
• Active Siblings: 175 of 256 IPs operational
• Threat Siblings: 178 IPs flagged
• Inherited Risk Score: 27
• Neighbor Risk Distribution: 99 medium-risk, 1 low-risk, 0 high-risk

The subnet's high abuse density correlates with the target IP's moderate risk score (40), indicating potential network-level compromise patterns.

---

Threat Indicators

• Blacklist Status: Listed on 1 of 8 DNSBL lists
• Known Campaigns: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Indicators: None observed
• Campaign Likelihood: None

---

Service Exposure

• Open Ports: None detected
• DNS PTR: proxy-ca006-san192.ahrefs.net
• Forward Resolution: Confirmed to ahrefs.net
• Service Status: Firewall / No Services accessible
• SSL/TLS: No certificates observed

---

Historical Activity

Observation Count: 27 signals recorded

• Recent Activity: June 17-18, 2026
• Routing Signals: Consistent OVH cloud hosting classification
• Ownership Stability: No ownership changes detected
• Threat Persistence: Single observation, not persistently malicious

---

Recommended Actions

Immediate:

1. Monitor traffic patterns from 142.44.220.192

2. Validate geolocation claims through alternative sources

3. Review DNSBL listing for specific blacklist details

Firewall Recommendations:

```bash

# iptables

iptables -A INPUT -s 142.44.220.192 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.220.192 drop

```

Note: Blocking recommendations are probabilistic. Given the moderate risk score (40) and lack of active threat indicators, consider allowing traffic while maintaining enhanced logging and monitoring.

---

Intelligence Assessment

This IP represents a moderate-risk cloud infrastructure endpoint in an elevated-risk subnet. The geolocation validation failure and high subnet abuse density suggest this may be part of a compromised hosting environment. The absence of direct threat indicators and lack of open services reduces immediate threat likelihood. Recommend maintaining enhanced monitoring without immediate blocking unless additional threat intelligence confirms malicious activity from this subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.