142.44.225.218📋 Copy

## IP Intelligence Briefing: 142.44.225.218/32

Executive Summary

IP 142.44.225.218 is a Moderate Risk (Risk Score: 50) address hosted on OVH infrastructure, currently firewalled with no open services. The IP demonstrates no active threat indicators but operates within a high-abuse density subnet (142.44.225.0/24) with significant sibling threat presence.

Infrastructure Profile

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 142.44.225.0/24
• Classification: CloudCompute, Hosting
• Geolocation: Canada (CA) – Regional inconsistencies detected
• DNS Resolution: proxy-ca017-san218.ahrefs.net (forward confirmed: false)
• Service Status: Firewalled / No Services Detected

Risk Assessment

• Overall Risk Score: 50 (Moderate)
• Abuse Confidence: Not currently elevated
• Threat Indicators: None detected
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Campaign Association: No known campaign matches
• Tor/Proxy/VPN: Not detected

Neighborhood Analysis

The /24 subnet (142.44.225.0/24) shows elevated abuse characteristics:

• Total Siblings: 256 IPs
• Active Siblings: 206
• Threat Siblings: 173
• Abuse Density Classification: High Abuse
• Inherited Risk Score: 27
• Neighbor Risk Distribution: 0 High, 46 Medium, 54 Low

Observation History

19 observations recorded, most recent on 2026-06-20. Signal timeline indicates:

• Network Classification: OVH hosting infrastructure
• Abuse Density: 0.6758 (High Abuse classification)
• Operator Score: 0.2174 (Minimal)
• Geolocation Signals: Multiple sources with confidence 0.35–0.85
• Route Stability: False (routing instability detected)

Relationships

44 relationship entities identified, predominantly same-network associations with OVH-CUST-281059696. No cross-network or organizational relationships detected beyond the hosting provider.

Recommended Actions

• Monitoring: Continue monitoring for service activation (ports opening)
• Blocking: No immediate block recommendation (no active threats)
• Investigation: Consider subnet-wide monitoring due to high abuse density
• Alerting: Set alerts for DNSBL list additions or service discovery

SOC Notes

This IP represents a dormant hosting address in a high-risk subnet. While currently benign, the subnet context warrants continued surveillance. Monitor for service activation or threat indicator emergence, particularly given 173 threat-sibling neighbors in the /24.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.