142.44.220.220📋 Copy

## INTELLIGENCE BRIEFING: 142.44.220.220/32

Classification: Moderate Risk (Score: 40) | Date: Current Analysis | Status: Actionable Intelligence

---

EXECUTIVE SUMMARY

IP address 142.44.220.220 is a cloud infrastructure endpoint hosted on OVH (ASN 16276), associated with Ahrefs Pte Ltd. The IP operates within a high-abuse subnet (142.44.220.0/24) exhibiting 62.89% abuse density. While the target IP shows no active threat indicators, its neighborhood context and geolocation inconsistencies warrant defensive posture.

---

OWNERSHIP & INFRASTRUCTURE

• Organization: Dmytro, Ahrefs Pte Ltd
• Network: OVH-CUST-281059685 (142.44.220.0/24)
• Provider: OVH (CloudCompute infrastructure)
• Classification: Cloud Hosting Environment
• Service Status: Firewalled / No Active Services Detected

---

GEOGRAPHIC ANALYSIS

• Reported Location: Canada (QC), Singapore (geolocation inconsistency)
• Geolocation Validation: FAILED — RTT measurement (27ms) contradicts stated distance (5,598km). Minimum possible RTT for this distance is 112ms, indicating potential spoofing or routing manipulation.
• Accuracy: 3,000km radius — low confidence geolocation data

---

THREAT INDICATORS

---

NETWORK NEIGHBORHOOD ANALYSIS

Subnet: 142.44.220.0/24 (256 total IPs)

Risk Distribution in /24:

• High Risk: 0
• Medium Risk: 99
• Low Risk: 1

Observation: The subnet exhibits elevated abuse density with 161 threat siblings, though the target IP (142.44.220.220) currently shows no active threat signals.

---

DNS & IDENTIFICATION

• PTR Record: proxy-ca006-san220.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Not confirmed
• Email Authentication: SPF/DMARC not detected
• HTTP Services: None detected (firewalled)

---

HISTORICAL OBSERVATIONS

Signal history indicates recent activity with multiple observations:

• June 9, 2026: Subnet abuse classification (high_abuse, 62.89% density)
• June 15, 2026: Current risk assessment (minimal operator score: 0.2174)
• Threat Persistence: No persistent malicious behavior detected
• Ownership Changes: Stable (0 changes recorded)

---

RECOMMENDED ACTIONS

Based on risk profile and neighborhood context, implement defensive controls:

```bash

# iptables

iptables -A INPUT -s 142.44.220.220 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.220.220 drop

# Cloudflare WAF

{"description":"Block 142.44.220.220 — IPDebrief risk score 40", "action":"block", "filter":{"expression":"ip.src eq 142.44.220.220"}}

# AWS WAF

{"Addresses":["142.44.220.220/32"], "Description":"IPDebrief risk 40"}

```

Priority: MEDIUM — Block based on neighborhood context and geolocation inconsistencies.

---

ANALYST NOTES

1. Geolocation Discrepancy: The RTT/distance mismatch suggests potential data quality issues or routing manipulation. Verify with independent sources.

2. Subnet Context: 62.89% abuse density in the /24 indicates this IP may be co-located with malicious actors. Implement subnet-level monitoring.

3. No Active Services: Target IP is currently firewalled with no open ports. Threat activity may originate from adjacent IPs.

4. Ahrefs Association: Legitimate SEO tool provider. Consider whitelisting if this IP is an internal endpoint, but maintain monitoring due to neighborhood abuse density.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.