142.44.228.139📋 Copy

# IP INTELLIGENCE BRIEFING

IP Address: 142.44.228.139/32

Date: 2026-06-29

Classification: MODERATE RISK

## EXECUTIVE SUMMARY

The target IP 142.44.228.139 is a cloud-based infrastructure host operated by OVH Canada within the 142.44.228.0/24 subnet. The IP resolves to a DNS hostname associated with Ahrefs (proxy-ca016-san139.ahrefs.net) but presents a moderate risk profile (Score: 40) with notable geolocation inconsistencies. The subnet exhibits high abuse density (0.66), with 169 of 205 active sibling IPs flagged as threats.

## INFRASTRUCTURE PROFILE

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• Network Block: 142.44.228.0/24
• Infrastructure Type: CloudCompute / Hosting
• Service Status: Firewalled / No Services Detected
• Geolocation Claimed: Canada, QC, Beauharnois (45.5075°N, -73.5887°W)

## RISK ASSESSMENT

Overall Risk Score: 40/100 (Moderate Risk)

## CRITICAL OBSERVATIONS

Geolocation Anomaly

Geolocation validation failed with significant RTT violation:

• Claimed distance: 5,598 km from probe origin
• Minimum possible RTT: 112ms
• Observed RTT: 29ms
• Implication: IP likely misreported or located in different region; distance discrepancy exceeds 5,500 km

Subnet Threat Context

The /24 subnet (142.44.228.0/24) shows elevated abuse patterns:

• Abuse Density: 0.66 (High)
• Threat Classification: high_abuse
• 169 threat siblings detected out of 205 active IPs
• Risk inheritance score: 26

DNS Infrastructure

• Forwarded hostname: proxy-ca016-san139.ahrefs.net
• Domain: ahrefs.net
• No forward confirmation (0.0.0.0)
• DNSSEC: Valid
• CAA Records: Present

## THREAT INDICATORS

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: None detected
• Blacklist Count: 0 (primary lists)

## RECOMMENDED ACTIONS

Firewall Rules (Immediate)

```bash

# iptables

iptables -A INPUT -s 142.44.228.139 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.228.139 drop

# nginx

deny 142.44.228.139;

```

WAF Configuration

• Cloudflare WAF: Block IP with expression `ip.src eq 142.44.228.139`
• AWS WAF: Add address 142.44.228.139/32 to rule set

## OBSERVATION HISTORY

Twenty signal observations recorded between June 16-29, 2026:

• June 29: DNS resolution for ahrefs.net (confidence: 0.80)
• June 21: Operator score 0.2174 (Minimal), network classification confirmed
• June 16: Geolocation probe with RTT validation failure

## ANALYST NOTES

1. Despite resolving to Ahrefs domain, the geolocation discrepancy (5,500+ km RTT violation) suggests potential spoofing or misconfiguration

2. High subnet abuse density warrants monitoring of related IPs in 142.44.228.0/24

3. No active services detected; IP appears to be a backend/proxy endpoint

4. Risk score of 40 indicates moderate concern—block if receiving unwanted traffic from this IP

---

*Intel generated from IPDebrief analysis. Combine with additional threat signals before taking action.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.