142.44.220.72📋 Copy

# IP Intelligence Briefing: 142.44.220.72

## Executive Summary

IP 142.44.220.72 presents a moderate risk profile (score: 40) with geolocation anomalies and high-abuse subnet characteristics. The address resolves to an Ahrefs infrastructure hostname but exhibits suspicious geolocation data inconsistent with network topology.

## Ownership and Network Context

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 142.44.220.0/24
• Infrastructure Type: CloudCompute / Hosting
• Network Classification: Cloud infrastructure with firewalled/no services detected

## Geolocation Anomalies

Critical geolocation validation failures observed:

• Claimed Location: Canada (QC) with Singapore city designation
• Distance Violation: 5,597.9 km from probe origin
• RTT Violation: Measured 27.0ms vs. minimum possible 112.0ms for claimed distance
• Assessment: Geolocation data deemed implausible; source integrity compromised

## Threat Indicators

• Risk Score: 40 (Moderate)
• DNSBL Listings: 1 of 8 threat lists
• Threat Indicators: None active
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Persistence: 0 days observed
• Campaign Correlation: None detected

## Neighborhood Analysis

The /24 subnet exhibits elevated abuse characteristics:

• Abuse Density: 0.6914 (High)
• Classification: high_abuse
• Active Siblings: 173 of 256
• Threat Siblings: 177
• Inherited Risk: 27

## Network Services

• Open Ports: None detected
• HTTP Services: No active web services
• TLS Certificates: None
• DNS PTR: proxy-ca006-san72.ahrefs.net
• Forward Resolution: 1 hostname resolved

## Historical Observations

• Total Signals: 21 observations tracked
• Recent Activity: DNS resolution to ahrefs.net domain confirmed
• Operator Score: 0.2174 (Minimal)
• Ownership Stability: No changes recorded
• Threat Observation Count: 0

## Relationship Graph

• Network Associations: Multiple relationships to OVH-CUST-281059685 network
• Subnet Classification: Cloud infrastructure customer network

## Recommended Actions

Firewall Rules

iptables:

```

iptables -A INPUT -s 142.44.220.72 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 142.44.220.72 drop

```

nginx:

```

deny 142.44.220.72;

```

WAF Rules

Cloudflare WAF: Block IP with expression `ip.src eq 142.44.220.72`

AWS WAF: Add 142.44.220.72/32 to block rule with description "IPDebrief risk 40"

## Intelligence Assessment

This IP requires defensive monitoring due to subnet-level abuse density and geolocation inconsistencies. While no active threat indicators are present, the high-abuse classification of the parent subnet and DNSBL listing warrant consideration for blocking or rate-limiting policies. The Ahrefs infrastructure association suggests legitimate use, but the geolocation validation failure indicates potential misconfiguration or spoofing. Monitor for any changes in threat indicators or service exposure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.