142.44.225.195📋 Copy

# IP Intelligence Briefing: 142.44.225.195

Classification: MODERATE RISK

Date: Current

Prepared For: SOC Analyst

---

## EXECUTIVE SUMMARY

IP 142.44.225.195 is a cloud infrastructure address hosted on OVH under Ahrefs Pte Ltd. The address presents moderate risk (score: 50) with evidence of DNS blacklist activity and operates within a high-abuse-density subnet. No active malicious campaigns or known attacker signatures detected.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network: OVH-CUST-281059696 (142.44.225.0/24)
• Infrastructure Type: Cloud Compute (OVH hosting)
• Classification: Cloud-hosted, firewalled service

---

## GEOLOCATION ANALYSIS

• Reported Location: Singapore (with CA country code)
• Observation: Geographic discrepancy detected between country code (CA) and city (Singapore), indicating potential geolocation spoofing or multi-region hosting
• DNS Records: proxy-ca017-san195.ahrefs.net (ahrefs.net)
• DNSSEC: Validated

---

## THREAT INDICATORS

• Risk Score: 50 (Moderate)
• Blacklist Status: 2 DNSBL listings out of 8 total lists (dnsblListedCount: 2)
• Threat Classifications:

- Not Tor exit node

- Not known attacker

- Not spam source

- No active campaigns detected

• Abuse Confidence Score: Not scored (insufficient data)

---

## SUBNET NEIGHBORHOOD (142.44.225.0/24)

• Abuse Density: 0.5625 (High abuse classification)
• Subnet Size: 256 total IPs, 174 active
• Threat Siblings: 144 IPs flagged as threats
• Risk Distribution: 97 medium risk, 3 low risk, 0 high risk
• Inherited Risk: 22

---

## OBSERVATION HISTORY (19 observations)

• Recent Blacklist Activity:

- 2026-06-20: Listed on 8 total lists with high severity

- 2026-06-17: Listed on 8 total lists with high severity

• Network-Level Signals: Subnet classified as high_abuse since 2026-06-09
• Threat Persistence: 0 threat persistence days observed
• Ownership Stability: No ownership changes recorded

---

## NETWORK RELATIONSHIPS

• Total Relationships: 41
• Primary Associations: Multiple "Same Network" relationships to OVH-CUST-281059696
• No Correlated Campaign IPs: 0 correlated IPs in known campaigns

---

## RECOMMENDED ACTIONS

1. Monitor DNSBL listings for escalation (currently 2 of 8 lists)

2. Investigate geographic discrepancy (CA country code vs Singapore city)

3. Block if internal policy requires blocking high-abuse-density subnet (142.44.225.0/24)

4. No immediate block recommended—IP is firewalled with no open services

5. Consider subnet-level filtering given 56.25% abuse density in /24

---

## ANALYST NOTES

This IP represents Ahrefs infrastructure on OVH cloud hosting. The moderate risk score reflects DNS blacklist activity rather than active exploit signatures. The high-abuse-density subnet environment warrants monitoring but does not indicate this specific IP is compromised. No evidence of command-and-control communication or malicious payload delivery observed.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.