142.44.225.171📋 Copy

# INTELLIGENCE BRIEFING: 142.44.225.171

## Executive Summary

IP 142.44.225.171 is a moderate-risk address (Score: 50) hosted on OVH cloud infrastructure. While the IP resolves to ahrefs.net, the subnet exhibits high abuse density with 155 threat siblings out of 206 active IPs. No active services were detected.

## Threat Profile

• Risk Score: 50 (Moderate Risk)
• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• Network: 142.44.225.0/24
• Infrastructure Type: CloudCompute / Hosting
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Operator Score: 0.2174 (Minimal)

## Geolocation & Network Classification

• Reported Location: Singapore (CA country code indicates data source inconsistency)
• Region: QC (Quebec)
• DNS PTR: proxy-ca017-san171.ahrefs.net
• Forward Resolution: proxy-ca017-san171.ahrefs.net
• Services: No open ports detected (Firewalled / No Services)

## Neighborhood Intelligence

The /24 subnet demonstrates elevated threat activity:

• Abuse Density: 0.6055 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 206
• Threat Siblings: 155
• Risk Distribution: 0 high, 97 medium, 3 low risk neighbors
• Inherited Risk Score: 24

## Observation History

• Total Observations: 19
• Recent Activity: 2026-06-17
• Threat Persistence: Not persistently malicious
• Latest Signals:

- High-severity blacklist listings (June 17, 2026)

- DNS CAA record validation confirmed

- Subnet abuse classification maintained

## Relationships

• 39 detected relationships
• Multiple same-network associations with OVH-CUST-281059696
• No known campaign correlations
• No certificate matches

## Recommended Actions

Based on the threat profile and neighborhood context:

1. Monitor Closely: While no active services were detected, the high abuse density of the parent subnet warrants ongoing monitoring for outbound malicious activity.

2. Block if Outbound Traffic: If this IP appears in outbound connection logs, consider blocking based on the DNSBL listings and moderate risk profile.

3. Contextual Evaluation: The ahrefs.net resolution suggests legitimate business use, but the blacklist presence indicates potential abuse of the infrastructure. Evaluate based on traffic patterns and volume.

4. Subnet-Wide Assessment: The 60% abuse density in 142.44.225.0/24 suggests potential infrastructure compromise or shared hosting abuse. Consider broader subnet monitoring.

## Intelligence Conclusion

IP 142.44.225.171 presents moderate risk with legitimate cloud hosting infrastructure but elevated neighborhood threat indicators. The high abuse density in the parent subnet and confirmed blacklist listings suggest the IP may be used for compromised services. Treat as suspicious pending traffic analysis.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.