142.44.225.114📋 Copy

## IP Intelligence Briefing: 142.44.225.114/32

Classification: Cloud Infrastructure IP | Risk Score: 30/100 (Low Risk)

---

Executive Summary

The IP address 142.44.225.114 is an OVH CloudCompute infrastructure endpoint associated with Ahrefs Pte Ltd. Despite a low individual risk score, the IP operates within a high-abuse-density subnet (0.6953 abuse density) containing 178 threat-adjacent sibling IPs. The IP is firewalled with no active services and presents moderate contextual risk due to neighborhood contamination.

---

Technical Profile

Ownership & Network:

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 142.44.225.0/24
• Infrastructure Type: CloudCompute (OVH hosting)
• Service Status: Firewalled / No Services Open

DNS Resolution:

• PTR Hostname: proxy-ca017-san114.ahrefs.net
• Domain: ahrefs.net
• Forward Confirmed: False (1 forward resolution)
• Email Authentication: No SPF or DMARC records detected

---

Geolocation Anomaly

Significant geolocation inconsistency detected:

• Claimed Location: Canada, Quebec
• Observed Distance: 5,597.9 km from probe location
• Minimum Possible RTT: 112ms
• Observed RTT: 31ms (112% below physical minimum)
• RTT Violation: 31.0ms < 112.0ms minimum

This indicates either routing anomaly, data center misreporting, or potential spoofing.

---

Neighborhood Risk Analysis

The /24 subnet (142.44.225.0/24) shows elevated neighborhood risk:

• Abuse Density: 0.6953 (high_abuse classification)
• Inherited Risk Score: 27/100
• Subnet Statistics: 223 active siblings out of 256 total
• Threat-Associated Siblings: 178 IPs

Risk distribution in subnet: 72 low-risk, 28 medium-risk, 0 high-risk IPs.

---

Threat Intelligence

Active Threat Indicators:

• Blacklist Count: 0
• DNSBL Listed: 1 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Persistence: 0 days
• Campaign Matches: 0

Historical Signals: 28 observations recorded with signals from June 2026 showing consistent infrastructure classification. One subnet-level signal (2026-06-20) confirmed high_abuse classification with 0.6953 abuse density.

---

Recommended Actions

Current Status: No immediate blocking recommended. Risk score (30) and absence of direct threat indicators support allowing traffic with standard logging.

SOC Considerations:

1. Monitor for any changes in threat indicators or service exposure

2. Correlate with neighborhood IPs showing 178 threat-associated siblings

3. Review geolocation discrepancy for potential spoofing indicators

4. Log all connections for baseline establishment (no active services currently)

Firewall Rules: None required based on current risk profile. Standard logging recommended for anomaly detection.

---

Intel Source: IPDebrief Analysis | Report Date: 2026

Classification: SOC Intelligence Briefing | Action Priority: Monitor

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.