142.44.220.9📋 Copy

# IP Intelligence Briefing: 142.44.220.9

Classification: Moderate Risk | Date: 2026-06-28

## Executive Summary

IP 142.44.220.9 operates within OVH cloud infrastructure under the organization Dmytro, Ahrefs Pte Ltd (ASN 16276). The address is associated with the ahrefs.net domain (proxy-ca006-san9.ahrefs.net) and maintains a moderate risk profile with a risk score of 40. The IP is firewalled with no open services detected, but resides in a subnet with elevated abuse density (0.6836) and high-abuse classification.

## Ownership and Infrastructure

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• Network: OVH-CUST-281059685
• CIDR Block: 142.44.220.0/24
• RIR: ARIN
• Infrastructure Type: CloudCompute/Hosting

## Geolocation

• Country: Canada (CA)
• Region: Quebec (QC)
• City: Singapore (geolocation discrepancy noted)
• Accuracy Radius: 3,000 km
• Geo Source Count: 1

## Threat Assessment

• Risk Score: 40 (Moderate)
• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Threat Persistence Days: 0
• Is Persistently Malicious: No

## Network Role and Services

• Provider: OVH
• Connection Type: Cloud hosting
• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: Not configured
• HTTP Title: Not available

## DNS Intelligence

• PTR Hostname: proxy-ca006-san9.ahrefs.net
• Forward Resolution: proxy-ca006-san9.ahrefs.net
• Forward Confirmed: No
• Domain: ahrefs.net
• CAA Records: Present
• DNSSEC: Valid
• DNSBL Listed: 1 of 8 lists

## Neighborhood Analysis

• Subnet: 142.44.220.0/24
• Abuse Density: 0.6836 (High abuse)
• Total Siblings: 256
• Active Siblings: 194
• Threat Siblings: 175
• Inherited Risk: 27
• Risk Distribution: High: 0, Medium: 35, Low: 65

## Observation History

19 total observations recorded. Key timeline:

• 2026-06-28: Subnet abuse density decreased to 0.3438, classification shifted to mixed, inherited risk reduced to 13
• 2026-06-20: Classification recorded as high_abuse with inherited risk of 27; provider confirmed as OVH; cloud and hosting flags confirmed; domain ahrefs.net with CAA records observed
• Geolocation: Inconsistencies detected with coordinates (56.13, -106.35) suggesting potential data anomalies

## Relationship Graph

43 relationships identified, all mapped to same network entity OVH-CUST-281059685, indicating the IP is part of a larger cloud infrastructure block.

## Recommended Actions

Based on the moderate risk profile and firewalled service status:

1. Allow with Monitoring: No immediate block required; the IP shows no active malicious indicators

2. Traffic Analysis: Monitor outbound connections for suspicious patterns given the high-abuse neighborhood context

3. DNSBL Verification: Confirm listing status across the 8 identified DNSBL providers

4. Geolocation Validation: Investigate city/region discrepancy for operational context

5. Subnet Correlation: Consider correlating with other 142.44.220.0/24 addresses showing medium-high risk scores

## Risk Indicators

• Primary: High-abuse neighborhood classification with 175 threat-sibling IPs in same /24
• Secondary: Geolocation data inconsistencies; DNSBL presence on 1 of 8 lists
• Mitigating: No active threat indicators; no known campaigns; firewalled service state

Analyst Notes: This IP appears to be legitimate cloud infrastructure for ahrefs.net (a legitimate SEO analytics service), but the subnet's high abuse density warrants continued monitoring. The recent decrease in abuse density suggests the IP may have been cleaned of any prior issues.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.