142.44.220.63📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 142.44.220.63/32

Date: Analysis completed based on IPDebrief data

## Executive Summary

IP 142.44.220.63 presents as a moderate risk (score: 40) cloud infrastructure host within the OVH provider environment. The IP operates from a subnet exhibiting high abuse density (0.6484) with 166 threat siblings identified. Current threat indicators are minimal, but the neighborhood context warrants monitoring.

## Ownership & Network Context

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: AS16276 (OVH SAS)
• CIDR Block: 142.44.220.0/24
• Infrastructure Type: CloudCompute/Hosting
• Registration RIR: ARIN

## Geolocation Anomalies

Geolocation data contains inconsistencies: country code reports CA (Canada) while coordinates map to Singapore region (QC). Geolocation validation flagged as implausible (geoPlausible: false) with RTT violations—measured 23ms against minimum possible 112ms for reported 5,598km distance. Multiple geo sources (count: 2) were consulted but consensus validation failed.

## Threat Intelligence Assessment

• Risk Classification: Moderate Risk (Score: 40)
• Threat Indicators: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Status: Listed on 1 of 8 DNSBL lists
• Operator Score: 0.2174 (Minimal)
• Reputation: 0 (ALIENVAL)

## Network Behavior & Services

• Open Ports: None (Firewalled / No Services)
• DNS PTR: proxy-ca006-san63.ahrefs.net
• Forward Resolution: ahrefs.net
• Email Auth: No SPF or DMARC records detected

## Subnet Neighborhood Analysis

The /24 subnet (142.44.220.0/24) demonstrates elevated abuse characteristics:

• Total Siblings: 256 IPs
• Active Siblings: 175
• Threat Siblings: 166
• Abuse Density: 0.6484 (high_abuse)
• Inherited Risk: 25
• Neighbor Sample Risk Distribution: 100 medium, 0 high, 0 low

## Historical Signal Trends

Analysis covered 21 observations from late June 2026 timeframe:

• Recent Risk Signals: Operator scores ranged 0.087–0.2174 (minimal)
• Subnet Abuse Classification: Persistently high_abuse (0.6484 density)
• Observation Frequency: Active monitoring signals with confidence levels 0.21–0.75

## Relationships

49 network relationships identified, all mapping to the same network identifier (OVH-CUST-281059685).

## Recommended Actions

1. Block: Consider blocking at perimeter if not already filtered; IP is on 1 DNSBL list

2. Monitor: Subnet abuse density warrants continued observation of related IPs

3. Validate: Geolocation inconsistencies may indicate spoofing or misconfiguration

4. Context: No direct threat indicators detected; risk driven by neighborhood context

---

Classification: SOC Monitoring

Data Sources: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.