142.44.225.71📋 Copy

## IP Intelligence Briefing: 142.44.225.71/32

Classification: Moderate Risk | Risk Score: 40/100

Analysis Date: Current Intelligence Cycle

---

**Ownership & Network Context**

The IP address 142.44.225.71 belongs to OVH SAS (AS16276) under organization "Dmytro, Ahrefs Pte Ltd" within CIDR block 142.44.225.0/24. The subnet is registered with ARIN. The IP is classified as cloud infrastructure (OVH-CUST-281059696) with service purpose indicated as "Firewalled / No Services."

**Geolocation Discrepancies**

Geolocation data indicates country CA (Canada) with region QC, though the reported city is Singapore. This geographic inconsistency is flagged as implausible (geoPlausible: false). RTT measurements show 27ms average against a minimum possible 112ms for the reported distance, indicating potential geolocation spoofing or routing anomalies.

**DNS & Hostname Resolution**

Reverse DNS resolves to proxy-ca017-san71.ahrefs.net. The associated domain ahrefs.net shows no SPF, DMARC, or TXT record configurations. Forward DNS resolution is confirmed (count: 1).

**Service Exposure**

No open ports detected. The IP shows no active services, TLS certificates, or HTTP banners. This indicates either firewall-protected infrastructure or passive host configuration.

**Threat Indicators**

• Blacklist count: 0
• Known attacker flag: false
• Spam source flag: false
• Tor exit node: false
• No active threat campaigns detected
• Pulsedive risk: null
• DNSBL listed: 1 of 8 total lists
• Abuse confidence score: null

**Neighborhood Analysis**

The /24 subnet (142.44.225.0/24) exhibits elevated abuse characteristics:

• Abuse density: 56.25%
• Classification: high_abuse
• Threat siblings: 144 out of 256 total IPs
• Inherited risk score: 22
• Subnet risk profile shows 96 medium-risk neighbors out of 100 sampled

**Observation History**

19 total observations recorded. Recent signals (June 2026 timeframe) show:

• ASN: AS16276 ovh sas
• Geographic attribution: CA with confidence 0.75
• Operator score: 0.2174 (Minimal)
• Route stability: false
• No persistent malicious activity detected (threatPersistenceDays: 0)

**Recommendations**

The IP presents moderate risk with elevated neighborhood context but no active threat indicators. The geolocation inconsistency and DNSBL listing warrant monitoring. Given the firewalled nature and lack of open services, immediate blocking is not indicated. Recommended actions:

• Monitor for service activation
• Track geolocation consistency
• Review DNSBL listings for context
• Consider subnet-level monitoring due to high abuse density

---

Intel Summary: This is a cloud-hosted infrastructure IP (OVH) with moderate risk rating. While showing no active threats or open services, the subnet exhibits elevated abuse density. The geolocation inconsistency and DNSBL listing suggest warranting continued observation rather than immediate blocking.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.