142.44.225.227📋 Copy

# IP Intelligence Briefing: 142.44.225.227/32

Classification: Moderate Risk | Provider: OVH | Report Date: Current Analysis

## Executive Summary

IP 142.44.225.227 is a cloud hosting endpoint operated by OVH (ASN 16276) under organization "Dmytro, Ahrefs Pte Ltd". The IP resolves to DNS hostname proxy-ca017-san227.ahrefs.net, indicating association with Ahrefs SEO analytics infrastructure. While the individual IP presents moderate risk (score: 40), it resides within a subnet exhibiting high abuse density (0.6758), warranting defensive caution.

## Key Findings

Infrastructure Profile

• Provider: OVH Cloud (CloudCompute/Hosting infrastructure)
• CIDR Block: 142.44.225.0/24
• ASN: 16276 (OVH)
• Network Classification: Cloud hosting with no open services detected
• DNS Records: proxy-ca017-san227.ahrefs.net (forward confirmed)

Geolocation Anomalies

Geolocation data shows significant inconsistency:

• Listed Country: Canada (CA)
• Listed City: Singapore
• Distance Anomaly: 5,597.9 km with RTT of 26ms (minimum possible: 112ms)
• Assessment: Geographic validation failed; indicates spoofed or unreliable location data

Neighborhood Analysis

The /24 subnet (142.44.225.0/24) demonstrates elevated threat activity:

• Abuse Density: 0.6758 (HIGH ABUSE classification)
• Threat Siblings: 173 out of 256 total IPs
• Active Siblings: 223
• Inherited Risk Score: 27
• Risk Distribution: 40 medium, 60 low, 0 high-risk neighbors

Threat Indicators

• Abuse Confidence: Not scored
• Blacklist Status: 0 blacklists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Feeds: None
• Campaign Association: None detected

Historical Observations

Analysis of 21 historical observations reveals consistent infrastructure classification:

• Cloud hosting designation maintained across observation period
• OVH provider consistently identified
• DNS records for ahrefs.net domain present
• No evidence of persistent malicious behavior or ownership changes

## Risk Assessment

The IP presents moderate risk (score: 40) primarily due to subnet-level abuse characteristics rather than individual threat indicators. Key concerns include:

• High-abuse density subnet environment
• Geographic data inconsistencies
• Hosting infrastructure associated with shared cloud resources

## Recommended Actions

Despite the moderate individual risk score, the subnet abuse density warrants defensive positioning. Recommended firewall rules:

```bash

# iptables

iptables -A INPUT -s 142.44.225.227 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.225.227 drop

```

Cloud Platform Recommendations:

• Cloudflare WAF: Block IP (expression: ip.src eq 142.44.225.227)
• AWS WAF: Add IP 142.44.225.227/32 to block list

## Intelligence Notes

The IP resolves to Ahrefs domain infrastructure, suggesting potential legitimate use cases. However, the high-abuse subnet context and geolocation anomalies indicate this IP may be compromised or misused within the OVH cloud environment. SOC teams should monitor for lateral movement patterns within the 142.44.225.0/24 subnet and consider blocking the entire CIDR if business requirements permit.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.