142.44.225.99📋 Copy

# IP Intelligence Briefing: 142.44.225.99/32

## Executive Summary

IP 142.44.225.99 is a moderate-risk (40) cloud-hosting address operated by OVH SAS under customer account OVH-CUST-281059696. The IP resolves to ahrefs.net infrastructure with geolocation inconsistencies and is hosted in a high-abuse density subnet. No active threat indicators were observed, but the subnet shows elevated abuse activity.

## Profile Overview

## Geolocation Analysis

Multiple geolocation sources reported conflicting data:

• Country: Canada (CA)
• City: Singapore
• Geolocation Violation: RTT measurement (27ms) inconsistent with claimed distance (5,598km). Minimum possible RTT for this distance would be 112ms, indicating significant data integrity issues.

## Threat Indicators

• Blacklist Count: 0
• DNSBL Listed: 1 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Indicators: None detected

## Network Context & Neighborhood Analysis

The IP resides in subnet 142.44.225.0/24 with the following characteristics:

• Abuse Density: 0.6953 (High Abuse Classification)
• Inherited Risk: 27
• Total Subnet IPs: 256
• Active Siblings: 223
• Threat Siblings: 178

Risk distribution in neighboring IPs shows predominantly low-risk activity (74 low, 26 medium, 0 high), suggesting the subnet hosts legitimate services alongside abusive actors.

## Observed Relationships

The IP is associated with network entity OVH-CUST-281059696. The relationship graph contains 45 entries, primarily indicating same-network associations. No unique organizational or certificate-based relationships were identified beyond the network-level connection.

## Signal History (Recent 21 Observations)

• 2026-06-20 16:12:47: DNS resolution to ahrefs.net (confidence: 0.80)
• 2026-06-20 16:05:46: Country detection: CA (confidence: 0.18)
• 2026-06-20 16:05:26: Subnet abuse density observed: 0.6953 (confidence: 0.75)
• 2026-06-20 16:05:00: ASN detection: AS16276 ovh sas, country CA, has threats (confidence: 0.75)
• 2026-06-20 16:03:55: Operator score: Minimal (0.2174) (confidence: 0.60)

No evidence of persistent malicious behavior or campaign correlation.

## Recommended Security Actions

Based on the risk profile, the following blocking rules are recommended:

```bash

# iptables

iptables -A INPUT -s 142.44.225.99 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.225.99 drop

# nginx

deny 142.44.225.99;

# pfSense

142.44.225.99/32

# Cloudflare WAF

action: block, expression: ip.src eq 142.44.225.99

# AWS WAF

Addresses: 142.44.225.99/32

Description: IPDebrief risk 40

```

## Assessment

The IP address represents a cloud-hosted infrastructure component with moderate risk scoring. While no direct malicious activity was observed, the subnet's high abuse density (0.6953) and 178 threat siblings suggest elevated risk of association with malicious actors. The geolocation inconsistencies warrant monitoring.

Recommendation: Implement blocking rules at perimeter defenses. Monitor for changes in service patterns or emergence of threat indicators. The IP's association with ahrefs.net infrastructure indicates potential legitimate use alongside potentially abusive neighbors in the same subnet.

---

*Intelligence generated from IPDebrief analysis. Recommendations should be validated against local security context before implementation.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.