142.44.225.178📋 Copy

IP Intelligence Briefing: 142.44.225.178

Date: 2026-06-15

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Ownership:

- ASN: 16276 (OVH)

- Organization: Dmytro, Ahrefs Pte Ltd

- Netname: OVH-CUST-281059696

• Geolocation:

- Country: Canada (CA)

- City: Singapore (discrepancy noted; geo validation flags as implausible)

- Distance: 5,598 km (RTT 28.2ms, minimum possible RTT: 112ms)

• Network Role:

- Infrastructure: CloudCompute (OVH)

- Hosting: Yes

- Subnet: 142.44.225.0/24

---

**2. Threat Indicators**

• No direct malicious indicators (no abuse confidence, spam, or known attacker flags).
• DNS Associations:

- Linked to `proxy-ca017-san178.ahrefs.net` (Ahrefs Pte Ltd).

• Geo Validation:

- Plausibility: False (distance and RTT mismatch).

- Spoofing Risk: Possible misconfiguration or location spoofing.

---

**3. Observation History**

• Last 30 Days:

- Subnet Abuse Density: 53.52% (high_abuse classification).

- Threat Siblings: 137 IPs in the subnet flagged as threats.

- Active Siblings: 172 IPs (256 total).

• Behavioral Flags:

- RTT Anomalies: Observed RTT (28.2ms) significantly lower than minimum possible (112ms).

- Geo Plausibility: False (5598km distance vs. claimed Singapore location).

---

**4. Network Relationships**

• Connected Entities:

- Subnet: 142.44.225.0/24 (OVH-CUST-281059696).

- DNS: `proxy-ca017-san178.ahrefs.net` (Ahrefs).

- Provider: OVH (cloud infrastructure).

---

**5. Neighborhood Analysis**

• Subnet Risk:

- Abuse Density: 53.52% (high_abuse).

- Risk Distribution: 96 IPs rated medium, 4 low, 0 high.

• Neighboring IPs:

- 137 IPs in the subnet flagged as threats.

- 172 active IPs (256 total).

---

**6. Recommendations**

• Monitor Subnet: High abuse density suggests potential for lateral movement or compromised hosts.
• Verify Geolocation: Investigate spoofing or misconfiguration (5598km vs. Singapore claim).
• Check DNS Security: Ensure DNS records for `proxy-ca017-san178.ahrefs.net` are secure (SPF/DKIM).
• Network Segmentation: Consider isolating this subnet if it hosts sensitive assets.

Conclusion: While the IP itself is not malicious, its subnet exhibits high abuse density and geo validation issues. SOC teams should prioritize monitoring the subnet for anomalous activity and validate the IP’s geolocation and DNS configurations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.