142.44.225.187📋 Copy

# IP Intelligence Briefing: 142.44.225.187/32

Classification: Moderate Risk (Score: 40)

Date: 2026-06-26

Reporting Tool: IPDebrief

---

## Executive Summary

IP 142.44.225.187 is a cloud compute infrastructure address hosted on OVH infrastructure (ASN 16276) under organization Dmytro, Ahrefs Pte Ltd. The IP resolves to proxy-ca017-san187.ahrefs.net but presents no open services. While the IP itself shows moderate risk characteristics, it operates within a high-abuse density subnet (0.6719) with 172 threat-sibling IPs in the /24 block.

---

## Infrastructure Profile

---

## Risk Assessment

Current Risk Profile

• Risk Score: 40/100 (Moderate Risk)
• Blacklist Status: Listed on 1 DNSBL out of 8 total lists
• DNSBL Severity: High severity listing present
• Abuse Confidence: Not quantified
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

Neighborhood Analysis

The /24 subnet (142.44.225.0/24) exhibits elevated abuse characteristics:

• Abuse Density: 0.6719 (High)
• Total Subnet IPs: 256
• Active Siblings: 224
• Threat Siblings: 172
• Inherited Risk: 26
• Risk Distribution: 76 medium, 24 low, 0 high

---

## Geolocation Validation

Status: INVALID

The IP's claimed geolocation (Beauharnois, QC, Canada) is geographically implausible:

• Claimed Distance: 5,597.9 km from probe origin
• Minimum Possible RTT: 112.0 ms
• Observed RTT: 26.0 ms
• Violation: RTT 26.0ms < minimum possible 112.0ms

This indicates the IP is likely routing through a proxy or CDN edge rather than originating from the claimed location.

---

## Observed Threat Indicators

DNS Blacklist Activity

• Total Lists: 8
• Listed: 1
• Maximum Severity: High
• Last Observed: 2026-06-26 19:03:51 UTC

Historical Signals (27 total observations)

• Most Recent: 2026-06-26

- DNS/Operator signal: Minimal operator score (0.087)

- DNSBL listing detected with high severity

- RTT violation signal (geolocation implausibility)

• Subnet Abuse Signal: 2026-06-22

- Subnet classified as high_abuse

- Abuse density: 0.6719

---

## Recommended Actions

Based on risk profile (40), the following firewall rules are recommended for blocking this IP:

---

## Analyst Notes

1. Context: The IP resolves to Ahrefs.net infrastructure, which may indicate legitimate use but also common abuse vector via compromised credentials or botnet infrastructure.

2. Subnet Risk: The /24 block shows significant abuse correlation (172 threat siblings). Consider evaluating traffic patterns from the entire subnet if blocking is not feasible.

3. Geolocation Discrepancy: The implausible RTT suggests the IP is not directly connected from the claimed Canadian location. Monitor for traffic originating from unexpected geographic regions.

4. No Active Services: The IP presents no open ports or services, suggesting it may be used for command-and-control, DNS tunneling, or other stealth operations.

Recommendation: Apply blocking rules to firewall perimeter. Monitor for lateral movement or C2 activity from related IPs in the subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.