142.44.220.200📋 Copy

IP INTELLIGENCE BRIEFING: 142.44.220.200/32

Classification: Low Risk (Risk Score: 25/100)

Date: Current Analysis

Provider: OVH (ASN: 16276, Organization: Dmytro, Ahrefs Pte Ltd)

Network Block: 142.44.220.0/24 (OVH-CUST-281059685)

---

EXECUTIVE SUMMARY

IP 142.44.220.200 operates within OVH CloudCompute infrastructure with a low-risk profile. The IP resolves to ahostname proxy-ca006-san200.ahrefs.net (ahrefs.net domain), indicating association with Ahrefs web analytics services. No active threat indicators, blacklists, or malicious campaigns detected. However, geolocation inconsistencies and elevated neighborhood abuse density warrant monitoring.

---

KEY FINDINGS

Risk Profile:

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Status: Clean (0 blacklists, 1 DNSBL listing)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No

Geolocation Discrepancies:

• Country: CA (Canada) vs. City: Singapore (inconsistent)
• GeoPlausibility: False
• Distance Violation: 5,598km with 27ms RTT (minimum expected 112ms)
• This indicates potential spoofing or CDN caching infrastructure

Infrastructure Classification:

• Type: CloudCompute (Hosting Provider)
• No open ports detected
• No active services (Firewalled/No Services)
• Not a CDN, VPN, Proxy, or Mobile carrier

---

NEIGHBORHOOD ANALYSIS (142.44.220.0/24)

• Subnet Abuse Density: 0.3555 (Mixed Classification)
• Inherited Risk Score: 14
• Total Siblings: 256 IPs
• Active Siblings: 226
• Threat Siblings: 91

Risk Distribution:

• High Risk: 0 (0%)
• Medium Risk: 60 (60%)
• Low Risk: 40 (40%)

The subnet shows moderate abuse density with 91 threat siblings, but the target IP itself maintains a clean profile.

---

OBSERVATION HISTORY

• Total Observations: 21 signals
• Recent Activity: Mixed geolocation signals (Canada primary), consistent provider classification
• Threat Persistence: None detected
• Ownership Changes: 0 (stable)

The IP has demonstrated consistent behavior with no escalation in threat activity over observation period.

---

RELATIONSHIP GRAPH

• Primary Association: OVH-CUST-281059685 network block (53 relationship entries)
• Associated Domain: ahrefs.net
• PTR Hostname: proxy-ca006-san200.ahrefs.net

No certificate correlations or additional entity relationships identified.

---

RECOMMENDED ACTIONS

No immediate blocking required. The IP presents as legitimate cloud infrastructure with low-risk characteristics. However, SOC analysts should:

1. Monitor for Geolocation Anomalies: The CA/Singapore discrepancy may indicate CDN edge caching or data inconsistency. Verify against known Ahrefs infrastructure locations.

2. Track Neighborhood Activity: With 91 threat siblings in the /24, monitor for correlated abuse patterns.

3. Maintain Baseline: Risk score (25) supports continued observation without aggressive filtering.

Firewall Rules: No action required. No deny/allow rules recommended.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.