142.44.220.196📋 Copy

IP Intelligence Briefing: 142.44.220.196

Date: 2026-06-17

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Provider: OVH (ASN 16276)
• Organization: Ahrefs Pte Ltd (registered to "Dmytro")
• Geolocation:

- Country: Canada (CA)

- Region: QC (Quebec)

- City: Singapore (potential inconsistency in geolocation data)

- Coordinates: Latitude/Longitude unspecified

- Accuracy Radius: 3,000 km

---

**2. Threat Indicators**

• No direct malicious indicators: No DNS abuse, blacklists, or spam sources detected.
• Subnet Risk:

- Abuse Density: 65.62% (high abuse classification)

- Threat Siblings: 168 out of 256 IPs in the 142.44.220.0/24 subnet are flagged as risky.

- Inherited Risk: 26 (substantial risk from neighboring IPs).

---

**3. Network Behavior**

• Network Role: Cloud compute (OVH hosting) with no CDN, VPN, or proxy activity.
• Open Ports/TLS: No open ports or TLS certificates detected.
• DNS:

- PTR hostname: `proxy-ca006-san196.ahrefs.net`

- No email authentication (SPF/DKIM) detected.

---

**4. Historical Observations (30-Day Window)**

• Risk Trends:

- Minimal risk score (0.2174) with no persistent malicious activity.

- Single observation recorded on 2026-06-13, no recent changes.

• Geolocation Plausibility: Flagged as implausible (distance inconsistencies).

---

**5. Relationships**

• Linked Entities:

- Network: OVH-CUST-281059685 (same subnet).

- Domains: Ahrefs.net (hostname `proxy-ca006-san196.ahrefs.net`).

• No direct campaign or certificate links.

---

**6. Recommended Actions**

1. Monitor Subnet: Given the high abuse density (65.62%) in 142.44.220.0/24, investigate traffic patterns and correlate with neighboring IPs.

2. Check Cloud Compute Activity: Verify if the OVH-hosted VM is compromised (e.g., unusual outbound traffic, unexpected services).

3. Geolocation Discrepancy: Investigate the conflicting geolocation data (Canada vs. Singapore) for spoofing or misconfiguration.

4. Block/Rate Limit: Consider temporary blocking or rate limiting based on subnet risk, especially if the IP is part of a larger malicious cluster.

---

Conclusion: While the IP itself shows no direct malicious activity, its subnet has a high abuse density, and the geolocation data is inconsistent. SOC teams should prioritize monitoring this subnet and validating the IP’s cloud-hosted environment for potential compromise.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.