142.44.225.18📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 142.44.225.18/32

Classification: Moderate Risk (Score: 40)

Report Date: 2026-06-20

---

## EXECUTIVE SUMMARY

IP 142.44.225.18 is a cloud hosting infrastructure address owned by Ahrefs Pte Ltd and provisioned through OVH cloud services. The IP operates within a high-abuse density subnet (0.7031) and resolves to the ahrefs.net domain namespace. While no active threat indicators are present, the neighborhood context suggests elevated risk from adjacent addresses.

---

## OWNERSHIP & NETWORK ATTRIBUTES

• Owner: Dmytro, Ahrefs Pte Ltd (AHREFS)
• ASN: 16276 (OVH)
• CIDR Block: 142.44.225.0/24
• Infrastructure Type: CloudCompute / Hosting
• Connection: Firewalled / No Active Services Detected

Geolocation Discrepancy: System indicates Canada (CA), but reverse DNS points to Singapore infrastructure. RTT measurements show 5,597.9km distance with 27ms latency, violating minimum possible RTT of 112ms for that distance—suggesting geolocation data may be unreliable.

---

## THREAT ASSESSMENT

Current Risk Score: 40/100 (Moderate)

Direct Threat Indicators:

• Blacklist listings: 0
• Known campaigns: None identified
• Tor exit node: No
• Known attacker: No
• Spam source: No

Control Plane Signals:

• DNSBL listings: 1 of 8 total lists flagged
• RPKI state: Unavailable
• Route stability: Unstable

---

## SUBNET ENVIRONMENT ANALYSIS

Subnet: 142.44.225.0/24

Abuse Density: 0.7031 (HIGH)

Inherited Risk: 28/100

Neighbor Profile (Sample of 256 siblings):

• Active siblings: 223
• Threat siblings: 180
• High-risk neighbors: 0
• Medium-risk neighbors: 23
• Low-risk neighbors: 77

Context: The /24 subnet exhibits elevated abuse density. While no direct threats are associated with this IP, 70% of active neighbors in the same subnet are flagged as threats. This contextual risk warrants monitoring.

---

## OBSERVATION HISTORY

Total Observations: 18 signals recorded

Last Updated: 2026-06-20

Recent signals indicate consistent classification patterns:

• Network classification: Cloud/hosting infrastructure (OVH)
• DNS resolution: proxy-ca017-san18.ahrefs.net
• Subnet abuse classification: High abuse
• Blacklist status: 1 listing detected

---

## RELATIONSHIP MAPPING

Total Relationships: 39

Primary Association: OVH-CUST-281059696 (34 duplicate references)

The IP maintains a single organizational relationship cluster tied to the OVH customer network block. No external organizational or certificate relationships detected.

---

## RECOMMENDED ACTIONS

Based on risk score (40) and neighborhood context, the following actions are recommended:

---

## INTELLIGENCE ANALYST NOTES

1. Subnet Risk: Consider blocking the entire /24 subnet (142.44.225.0/24) if traffic patterns justify it, given 0.7031 abuse density and 180 threat siblings.

2. Geolocation Validation: The Canada/Singapore discrepancy with RTT violations suggests automated geolocation errors. Verify physical location independently if forensic accuracy is required.

3. Reputation Context: While this specific IP shows no active malicious indicators, the hosting environment (OVH cloud) and neighborhood statistics warrant continued monitoring.

---

End of Briefing

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.