142.44.225.164📋 Copy

# IP Intelligence Briefing: 142.44.225.164/32

## Executive Summary

IP address 142.44.225.164 presents a Moderate Risk profile (Risk Score: 40) associated with OVH cloud infrastructure. The IP belongs to a high-abuse subnet with significant threat sibling density, warranting defensive monitoring and consideration for blocking based on operational context.

## Network Identity & Infrastructure

## Threat Assessment

• Overall Risk Score: 40/100 (Moderate)
• Abuse Confidence: No direct threat indicators
• Blacklist Status: Listed on 1 of 8 DNSBL lists
• Tor/Proxy/Vpn: Negative indicators (not detected)
• Campaign Correlation: No known campaigns associated

## Neighborhood Analysis (142.44.225.0/24)

The subnet exhibits elevated abuse characteristics:

• Abuse Density: 0.5859 (58.59%)
• Classification: High Abuse
• Threat Siblings: 150 out of 256 total IPs
• Active Siblings: 195
• Inherited Risk: 23

Neighbor risk distribution shows 97 medium-risk and 3 low-risk IPs, with no high-risk neighbors in the sample set.

## Historical Observations

19 signal observations recorded. Recent activity (2026-06-21) indicates:

• Consistent cloud/hosting classification
• Stable operator score (0.2174)
• DNSSEC valid with CAA records present
• Route stability flagged as unstable

## Relationship Mapping

The IP maintains strong DNS associations with `proxy-ca017-san164.ahrefs.net`, indicating legitimate infrastructure usage. Multiple "Same Network" relationships confirm OVH-CUST-281059696 network assignment.

## Recommended Defensive Actions

Based on risk profile, the following firewall rules are recommended:

## Intelligence Notes for SOC Analysts

1. Contextual Risk: While the hostname suggests legitimate Ahrefs infrastructure, the IP resides within a high-abuse OVH subnet. This discrepancy warrants monitoring.

2. DNSBL Presence: Listed on 1 of 8 DNSBL lists indicates prior reputation issues despite current low threat indicators.

3. No Open Services: Services enumeration shows no open ports, consistent with a firewalled configuration.

4. Action Threshold: Risk score of 40 combined with subnet abuse characteristics justifies blocking for sensitive environments.

Classification: Moderate Risk - Monitor/Block Based on Operational Context

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.