142.44.220.249📋 Copy

# THREAT INTELLIGENCE BRIEFING

Target: 142.44.220.249/32

Classification: MODERATE RISK

Date: Current Intelligence

Prepared For: SOC Operations Team

---

## EXECUTIVE SUMMARY

IP 142.44.220.249 is a cloud-hosted address assigned to OVH SAS (AS16276) within the OVH-CUST-281059685 customer block. The IP resolves to areverse DNS hostname (proxy-ca006-san249.ahrefs.net) associated with ahrefs.net. Current risk score is 40 (Moderate Risk) with no active open ports detected.

---

## OWNERSHIP & INFRASTRUCTURE

• Provider: OVH SAS (AS16276, OVH-CUST-281059685)
• Organization: Ahrefs Pte Ltd (Dmytro)
• Infrastructure Type: CloudCompute / Hosting
• Geolocation: Reported as Canada (QC) with coordinates pointing to Singapore — Geo-validation violation detected (RTT 27ms vs. minimum possible 112ms for 5,598km distance)
• BGP Prefix: 142.44.128.0/17

---

## THREAT INDICATORS

• Risk Score: 40 (Moderate)
• Blacklist Status: 0 explicit blacklists
• Threat Feeds: No active threat indicators
• Known Campaigns: None detected
• Control Plane: Route stability flagged as unstable (isRouteStable: false)
• DNSBL Status: Listed on 1 of 8 total DNSBLs

---

## OBSERVATION HISTORY

• Total Observations: 20 signals tracked
• Recent Activity: 2026-06-28 — Threat signals present (4 pulses detected)
• Historical Context: 2026-06-20 — Subnet classified as "high_abuse" with 0.6602 abuse density
• Threat Persistence: 0 days (no persistent malicious classification)
• Ownership Stability: 0 changes observed

---

## NEIGHBORHOOD ANALYSIS

• Subnet: 142.44.220.249/24
• Total Siblings: 256 IPs
• Active Siblings: 175
• Threat Siblings: 169
• Abuse Density: 0.6602 (High abuse classification)
• Risk Distribution: 0 High, 53 Medium, 47 Low (sample of 100 neighbors)

---

## NETWORK ROLE & SERVICES

• Infrastructure: CloudCompute (OVH hosting)
• Services: No open ports detected
• TLS/HTTP: No active services detected
• Classification: Firewall / No Services

---

## RELATIONSHIP GRAPH

• Total Relationships: 43
• Primary Links: Same Network (OVH-CUST-281059685) — 38+ occurrences
• Associated Hostnames: proxy-ca006-san249.ahrefs.net
• Associated Domain: ahrefs.net

---

## RECOMMENDED ACTIONS

Firewall Rules (Immediate)

```bash

# iptables

iptables -A INPUT -s 142.44.220.249 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.220.249 drop

# nginx

deny 142.44.220.249;

# pfSense

142.44.220.249/32

```

Cloud/WAF Rules

```json

// Cloudflare WAF

{

"description": "Block 142.44.220.249 — IPDebrief risk score 40",

"action": "block",

"filter": {"expression": "ip.src eq 142.44.220.249"}

}

// AWS WAF

{

"Addresses": ["142.44.220.249/32"],

"Description": "IPDebrief risk 40"

}

```

---

## ANALYST NOTES

1. Geo-spoofing detected — IP claims Canada location but RTT measurements indicate Singapore. Investigate if this is misconfiguration or deliberate masking.

2. High-abuse subnet — 169 of 175 active siblings in the /24 subnet flagged as threats. Consider blocking the entire 142.44.220.0/24 subnet if business requirements permit.

3. Ahrefs association — Despite DNS resolution to ahrefs.net infrastructure, no legitimate services detected (no open ports). May indicate compromised infrastructure or abandoned hosting.

4. Block recommendation supported by firewall rules generation, though disclaimer notes probabilistic nature. Combine with additional signals before enforcement.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.