142.44.220.80📋 Copy

# IP INTELLIGENCE BRIEFING

## Target: 142.44.220.80/32

## Classification: Moderate Risk – Cloud Hosted Proxy Infrastructure

---

EXECUTIVE SUMMARY

IP 142.44.220.80 is a cloud-hosted proxy server associated with Ahrefs, operating on OVH infrastructure. The IP carries a moderate risk score of 40 and demonstrates high-abuse neighborhood characteristics. No active malicious indicators were observed, but the IP's proxy function and elevated neighborhood abuse density warrant monitoring or blocking depending on organizational policy.

---

OWNERSHIP & INFRASTRUCTURE

• Provider: OVH (ASN 16276)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 142.44.220.0/24
• Infrastructure Type: CloudCompute (isCloud: true, isHosting: true)
• Service Purpose: Firewalled / No Services (no open ports detected)

---

GEOLOCATION ANALYSIS

• Country: Canada (CA)
• City: Singapore (reported with 3000km accuracy radius)
• Note: Geolocation data shows conflicting signals with significant accuracy limitations. The city designation appears inconsistent with the country code.

---

DNS & IDENTIFIERS

• PTR Record: proxy-ca006-san80.ahrefs.net
• Associated Domain: ahrefs.net
• Forward Resolution: Confirmed (1 hostname)
• Email Authentication: SPF and DMARC records absent

---

THREAT INDICATORS

• Risk Score: 40 (Moderate Risk)
• Threat Indicators: None active
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• DNSBL Listings: 1 of 8 total lists
• Campaign Association: None detected

---

NEIGHBORHOOD ANALYSIS

The IP operates within subnet 142.44.220.0/24, which exhibits elevated abuse characteristics:

• Abuse Density: 0.6602 (high_abuse classification)
• Total Siblings: 256
• Active Siblings: 175
• Threat Siblings: 169
• Risk Distribution: 52 medium-risk, 48 low-risk neighbors

The high concentration of threat-adjacent IPs in the /24 suggests the subnet is actively used for hosting services with mixed legitimacy.

---

OBSERVATION HISTORY

• Total Observations: 19 signals
• Most Recent: 2026-06-20T05:42:21Z
• Domain Confirmation: ahrefs.net confirmed on 2026-06-15T05:42:24Z
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0
• Status: Stable ownership, no escalation trends

---

RECOMMENDED ACTIONS

Based on risk profile and neighborhood context, the following firewall rules are recommended:

iptables:

```bash

iptables -A INPUT -s 142.44.220.80 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 142.44.220.80 drop

```

nginx:

```nginx

deny 142.44.220.80;

```

pfSense:

```

142.44.220.80/32

```

Cloudflare WAF:

```json

{

"description": "Block 142.44.220.80 — IPDebrief risk score 40",

"action": "block",

"filter": {"expression": "ip.src eq 142.44.220.80"}

}

```

AWS WAF:

```json

{

"Addresses": ["142.44.220.80/32"],

"Description": "IPDebrief risk 40"

}

```

---

INTELLIGENCE CONTEXT

The IP functions as an Ahrefs proxy server, likely used for web scraping, SEO analysis, or data collection services. While not directly malicious, the high-abuse neighborhood context and proxy designation suggest:

1. Potential for misuse by bad actors compromising proxy services

2. Legitimate traffic may be blocked by conservative policies

3. SOC analysts should weigh organizational requirements against neighborhood risk

Recommendation: Monitor for lateral movement or additional indicators if traffic is observed from this IP. Consider blocking if proxy services are not required for business operations.

---

*Report generated via IPDebrief intelligence platform. All data is current as of analysis timestamp.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.