142.44.228.132📋 Copy

# IP Intelligence Briefing: 142.44.228.132/32

Classification: Moderate Risk | Date: 2026-06-17

Intel Source: IPDebrief Intelligence Platform

---

## Executive Summary

IP address 142.44.228.132 presents a moderate risk profile with a composite risk score of 50. The endpoint is associated with OVH hosting infrastructure (ASN 16276, customer block OVH-CUST-281059695) and operates under the ownership of "Dmytro, Ahrefs Pte Ltd." While no direct threat indicators are present, the IP exhibits concerning neighborhood characteristics with elevated abuse density and significant threat sibling concentration within its /24 subnet.

---

## Network Infrastructure Profile

DNS Resolution: proxy-ca016-san132.ahrefs.net (ahrefs.net)

Services: No open ports detected (service purpose: Firewalled / No Services)

---

## Threat Intelligence Indicators

Direct Threat Indicators

• Blacklist Status: Listed on 2 of 8 monitored feeds
• Abuse Confidence: Not explicitly scored at IP level
• Known Campaigns: None identified
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False

Neighborhood Risk Assessment

• Subnet: 142.44.228.0/24
• Abuse Density: 0.5748 (High)
• Total Siblings: 254 (176 active)
• Threat Siblings: 146 (57% of active addresses)
• Classification: High Abuse
• Inherited Risk Score: 22

Analysis: The /24 subnet demonstrates elevated abuse density, with more than half of active neighbors flagged as threats. This suggests the subnet may be utilized for coordinated malicious activity or represents a compromised hosting block.

---

## Geolocation Discrepancies

Observed Locations:

• Canada, Quebec (CA)
• Singapore (inconsistently reported)

Assessment: Geographic inconsistency between multiple geolocation sources raises potential spoofing or misattribution concerns. The 3,000 km accuracy radius indicates limited confidence in precise location data.

---

## Historical Observations

Total Observations: 18 signals recorded

Key Temporal Signals:

• 2026-06-17: Blacklist listings detected across 8 feeds (2 active listings, maximum severity: high)
• 2026-06-15: Operator score recorded at 0.2174 (Minimal operator risk)
• 2026-06-09: DNS/CAA records observed for ahrefs.net domain

Risk Trajectory: Single threat observation event; not flagged as persistently malicious.

---

## Recommended Security Actions

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 142.44.228.132 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.228.132 drop

# NGINX

deny 142.44.228.132;

```

WAF Configuration

• Cloudflare WAF: Block with expression `ip.src eq 142.44.228.132`
• AWS WAF: Add to deny list with CIDR 142.44.228.132/32
• pfSense: Add to block list

Recommendation: Apply blocking rules pending correlation with additional threat intelligence. The moderate risk score combined with neighborhood abuse patterns warrants defensive posture.

---

## Intelligence Assessment

This IP address operates within a high-abuse-density subnet (142.44.228.0/24) where 57% of active neighbors are classified as threats. While the endpoint itself shows no direct malicious indicators and is properly registered with OVH hosting infrastructure, the elevated neighborhood risk suggests potential for misuse. The geolocation inconsistencies and blacklist presence support a cautious defensive approach.

Confidence Level: Moderate

Action Priority: Monitor/Block (pending additional context)

Recommended Action: Implement firewall blocking rules and monitor for related activity in the /24 subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.