142.44.228.145📋 Copy

# IP Intelligence Briefing: 142.44.228.145/32

## Executive Summary

IP address 142.44.228.145 is a moderate-risk (40/100) cloud-hosted address operated by OVH under customer OVH-CUST-281059695. The IP resolves to aforementioned domain proxy-ca016-san145.ahrefs.net and is classified within a high-abuse subnet (142.44.228.0/24) with 68% abuse density.

## Profile Overview

## Geographic Validation

The IP's geolocation data shows significant validation issues. The address is claimed to be located in Singapore (CA region), but RTT measurements indicate a distance of 5,597.9 km from the probe location. The minimum possible RTT for this distance is 112ms, yet observed RTT was only 27–32ms—a violation indicating the geolocation data is unreliable and the IP's actual location is unknown.

## Neighborhood Context

The /24 subnet 142.44.228.0/24 exhibits concerning abuse patterns:

• Abuse Density: 0.6797 (High)
• Active Siblings: 216 of 256
• Threat Siblings: 174 IPs flagged as threats
• Risk Distribution: 50 medium, 50 low, 0 high risk scores among sampled neighbors

This indicates the subnet is heavily utilized for potentially malicious activities, with the target IP inheriting an inherited risk score of 27 from neighborhood context.

## Historical Signals

Observation history shows 21 signals recorded between June 2026. Notable observations include:

• June 20: Cloud infrastructure classification confirmed (no CDN/VPN/proxy indicators)
• Recent observations show minimal operator scores (0.087–0.30)
• No persistent malicious activity detected (threatPersistenceDays: 0)
• Ownership stability with zero changes recorded

## Relationship Graph

The IP has 51 relationship records, predominantly "Same Network" associations to OVH-CUST-281059695. No external organization links, certificates, or correlated campaigns were identified.

## Recommended Actions

While no automated recommendations were generated, the following defensive measures are advised:

Firewall Blocking Rules:

• iptables: `iptables -A INPUT -s 142.44.228.145 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 142.44.228.145 drop`
• nginx: `deny 142.44.228.145;`
• Cloudflare WAF: Block IP with expression `ip.src eq 142.44.228.145`
• AWS WAF: Add rule for CIDR 142.44.228.145/32

Assessment Notes:

• The DNSBL listing indicates prior reputation concerns
• Subnet-level abuse density warrants consideration of blocking the entire /24 if threat correlation exists
• No services detected on the IP, suggesting it may be dormant or firewalled

## Conclusion

This IP represents a moderate-risk asset within a high-abuse subnet. The geographic validation failure and DNSBL listing suggest potential misconfiguration or prior misuse. SOC teams should monitor traffic patterns and consider blocking at the network perimeter given the subnet's abuse density and the IP's blacklist status.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.