142.44.220.232📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 142.44.220.232/32

Date: 2026-06-15

Classification: MODERATE RISK

---

## EXECUTIVE SUMMARY

IP 142.44.220.232 is a cloud hosting endpoint operated by OVH SAS (ASN 16276) located in Beauharnois, Quebec, Canada. The address resolves to the ahrefs.net domain infrastructure (proxy-ca006-san232.ahrefs.net). Risk assessment indicates moderate risk (score: 40) with elevated neighborhood abuse density. The IP is currently firewalled with no active services exposed.

---

## RISK PROFILE

Threat Indicators

• Blacklist Count: 0
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Active Threat Feeds: None
• Known Campaigns: None

---

## NEIGHBORHOOD ANALYSIS

The /24 subnet (142.44.220.0/24) exhibits significant abuse activity:

The subnet demonstrates elevated peer abuse rates. Of 100 sampled neighbors, 99 returned medium risk scores (40-50), with only 1 low-risk address. This pattern suggests the subnet is hosting multiple cloud endpoints with varying security postures.

---

## OBSERVATION HISTORY

Recent signal activity (2026-06-15) indicates:

1. Hosting Confirmation: IP confirmed as cloud hosting infrastructure (is_hosting: true)

2. Proxy/VPN Activity: One signal flagged proxy_type: VPN with confidence 0.85

3. Geolocation Consensus: Multiple sources confirm Canada/Quebec location

4. Control Plane: Operator score 0.2174 (Minimal); DNSSEC valid; RPKI state pending

Temporal analysis shows no persistent malicious activity (threatPersistenceDays: 0, isPersistentlyMalicious: false).

---

## DNS INFRASTRUCTURE

---

## NETWORK SERVICES

Status: Firewalled / No Services Detected

• Open Ports: None
• TLS Certificate: None
• HTTP Title: None
• Server Banner: None

---

## RELATIONSHIP MAPPING

The IP maintains 40 relationship connections, predominantly within the same network block (OVH-CUST-281059685). No external organization or certificate relationships detected.

---

## RECOMMENDED ACTIONS

Firewall Rules (Immediate)

WAF Configuration

Cloudflare WAF:

```json

{

"description": "Block 142.44.220.232 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 142.44.220.232"

}

}

```

AWS WAF:

```json

{

"Addresses": ["142.44.220.232/32"],

"Description": "IPDebrief risk 40"

}

```

---

## ANALYST NOTES

1. Context: This IP belongs to Ahrefs infrastructure (SEO analytics provider). Legitimate traffic should be expected for web scraping and proxy services.

2. Abuse Context: The subnet's high abuse density (0.6719) suggests compromised peers may exist alongside legitimate endpoints.

3. Monitoring: Consider monitoring for traffic patterns inconsistent with web proxy/scraper activity.

4. Decision Matrix: Given the moderate risk score and hosting context, blocking is recommended but should be evaluated against business requirements for legitimate ahrefs.net traffic.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.