142.44.228.113📋 Copy

# IP Intelligence Briefing: 142.44.228.113/32

Date: 2026-06-26

Analyst: SOC Threat Intelligence Team

Classification: Moderate Risk

---

## Executive Summary

IP address 142.44.228.113 is a moderate-risk (40/100) cloud computing host assigned to OVH (ASN 16276) under customer prefix OVH-CUST-281059695. The IP resolves to ahrs.net domain with PTR hostname proxy-ca016-san113.ahrefs.net. While the host shows no active open ports or TLS services, it resides within a high-abuse-density subnet (0.7031) containing 180 flagged threat IPs out of 256 total addresses.

---

## Technical Profile

---

## Threat Assessment

Current Threat Indicators: None detected at IP level. No known campaigns, spam sources, or attacker signatures.

Subnet Risk Profile:

• Abuse Density: 0.7031 (High)
• Threat IPs in /24: 180 of 256 addresses (70%)
• Risk Classification: High Abuse

Geolocation Validation: Significant discrepancy detected—country code indicates CA while city shows Singapore with 5,598km distance, creating RTT violation (29ms observed vs 112ms minimum possible). This suggests unreliable geolocation data.

---

## Historical Signals

The IP has accumulated 28 observations over the monitoring period. Recent signals include:

• June 2022: High abuse subnet classification confirmed (180 threat siblings)
• June 2022: Ownership persistence signals indicate non-persistent malicious activity
• No evidence of persistent malicious behavior pattern

---

## Network Relationships

• Primary Association: OVH-CUST-281059695 (62 relationship entries)
• Related Networks: Multiple same-network entries to OVH customer prefix
• Domain Context: ahrefs.net (SEO tooling services)

---

## Recommended Actions

Based on risk profile and subnet abuse context, the following blocking rules are recommended:

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 142.44.228.113 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.228.113 drop

# Nginx

deny 142.44.228.113;

# pfSense

142.44.228.113/32

# Cloudflare WAF

{"description":"Block 142.44.228.113 — IPDebrief risk score 40","action":"block"}

# AWS WAF

{"Addresses":["142.44.228.113/32"],"Description":"IPDebrief risk 40"}

```

---

## Intelligence Notes

1. Subnet Context: The /24 subnet shows elevated abuse activity. Consider evaluating the full 142.44.228.0/24 range for potential lateral threat indicators.

2. Cloud Hosting: Hosted on OVH cloud infrastructure with no publicly exposed services. Traffic patterns may indicate internal scanning or lateral movement attempts.

3. DNS Activity: Forward resolution confirmed to ahrs.net infrastructure, consistent with SEO tooling services. Monitor for abuse of this domain's infrastructure.

4. Risk Mitration: While individual IP shows moderate risk, the subnet-level abuse density (0.7031) warrants broader monitoring of the 142.44.228.0/24 prefix.

---

End of Briefing

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.