142.44.220.226📋 Copy

INTELLIGENCE BRIEFING: 142.44.220.226

Classification: Moderate Risk | Risk Score: 40/100

Overview

IP 142.44.220.226 is a cloud compute infrastructure address assigned to OVH-CUST-281059685, a customer network under OVH Holdings (AS16276). The address resolves to the ahrefs.net domain (proxy-ca006-san226.ahrefs.net) but currently presents no open services or active ports. Geolocation data indicates Quebec, Canada (Beauharnois) but shows validation inconsistencies with reported RTT anomalies.

Network Context

The IP resides in a high-abuse density subnet (142.44.220.0/24) with an abuse density score of 0.6719. Of 256 total siblings, 172 are classified as threats. The subnet inherits a risk score of 26 from neighborhood activity. Control plane analysis shows the BGP prefix 142.44.128.0/17 is not route-stable, and DNSSEC validation is enabled.

Threat Indicators

No active threat indicators detected:

• Blacklist count: 0
• Known campaigns: None
• Tor exit: False
• Known attacker flag: False
• Spam source flag: False

However, the IP appears on 1 of 8 DNSBL lists, warranting monitoring.

Observation History

Twenty-four observations recorded between June 14-19, 2026. Operator score remains consistent at 0.2174 across all observations, indicating stable but elevated risk profile. No persistent malicious behavior detected.

Infrastructure Assessment

• Type: Cloud Compute (OVH)
• Status: Firewalled / No Services
• DNS: Forward resolution to proxy-ca006-san226.ahrefs.net
• Email Auth: SPF and DMARC records absent
• Certificates: None detected

Recommended Actions

Based on risk profile, blocking is recommended:

```bash

# iptables

iptables -A INPUT -s 142.44.220.226 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.220.226 drop

# nginx

deny 142.44.220.226;

# pfSense

142.44.220.226/32

# Cloudflare WAF

{

"description": "Block 142.44.220.226 — IPDebrief risk score 40",

"action": "block",

"filter": {"expression": "ip.src eq 142.44.220.226"}

}

# AWS WAF

{

"Addresses": ["142.44.220.226/32"],

"Description": "IPDebrief risk 40"

}

```

Intelligence Notes

While the IP lacks direct threat indicators, the high-abuse neighborhood context and DNSBL presence suggest defensive blocking is appropriate. Monitor for service changes or new threat indicators. The ahrefs.net association may indicate legitimate use, but the subnet-level abuse density warrants continued surveillance.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.