142.44.228.20
IP Intelligence Briefing for 142.44.228.20/32
*Generated via IPDebrief tools: Profile, History, Relationships, Neighbors*
---
**Key Findings**
1. Risk Profile:
- Overall Risk: Low (Risk Score: 25).
- Provider: OVH (ASN 16276), registered to Ahrefs Pte Ltd (hosting provider).
- Geolocation: Listed as Canada (QC, Montreal) but associated with a Singapore-based hostname (`proxy-ca016-san20.ahrefs.net`). Potential misclassification or misconfigured DNS.
2. Threat Indicators:
- No malicious activity detected (no indicators, blacklists, or campaigns).
- DNS Associations: Linked to `proxy-ca016-san20.ahrefs.net` (likely internal infrastructure).
3. Network Role:
- Classified as hosting/cloud infrastructure (OVH).
- Subnet 142.44.228.0/24 shows mixed abuse density (0.46), with 115/247 IPs flagged as threats.
4. Observation History:
- Recent activity (June 2026) shows stable risk profile.
- Low-confidence signals suggest no recent anomalous behavior.
5. Neighborhood Analysis:
- Subnet contains 123 active IPs, 115 of which are flagged as threats.
- 142.44.228.20 itself has no direct risk, but its subnetβs high abuse density warrants monitoring.
---
**Actionable Intelligence**
- SOC Analyst Recommendations:
- Validate geolocation discrepancies (Canada vs. Singapore). Check if DNS misconfigurations are intentional.
- Monitor the 142.44.228.0/24 subnet for lateral movement orε ³θ with known malicious IPs.
- Confirm if Ahrefsβ DNS records (`proxy-ca016-san20.ahrefs.net`) are part of legitimate infrastructure.
- Consider implementing network segmentation to isolate this subnet from critical assets.
- Firewall/Network Rules:
- No immediate blocking required for this IP, but ensure rules allow traffic only to trusted subnets.
- Use IPDebriefβs firewall recommendations for OVH ASN (16276) if broader mitigation is needed.
---
**Conclusion**
The IP is associated with a legitimate hosting provider (Ahrefs) but resides in a subnet with notable abuse activity. While the IP itself is low-risk, its proximity to malicious entities in the same subnet suggests the need for closer monitoring and potential network segmentation.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
π’ Ownership & Registration
| Organization | Dmytro, Ahrefs Pte Ltd |
| ASN | AS16276 |
| Network Name | OVH-CUST-281059695 |
| CIDR Block | 142.44.228.0/24 |
| RIR | ARIN |
| Country | Singapore |
| Abuse Contact | β |
π DNS Intelligence
| PTR | proxy-ca016-san20.ahrefs.net |
| Forward Confirmed | No β PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-ca016-san20.ahrefs.net |
π DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
βοΈ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting β Infrastructure provider without advanced routing |
π Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | β |
| HTTP Title | β |
π TLS Certificate
| SANs | None |
| Valid From | β |
| Valid Until | β |
π― Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 39% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 15% | 2 | 2 |
| ownership | 15% | 2 | 2 |
| reputation | 22% | 1 | 2 |
| geolocation | 39% | 2 | 3 |
| Overall | 24% | 10 | 13 |
| Data Coherence | Mostly Consistent (80%) β 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
π Observation Timeline π Live
| First Seen | 2026-05-17 21:14:16 UTC |
| Last Seen | 2026-06-28 05:43:05 UTC |
| Profile Built | 2026-06-28 23:48:49 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 24 |
Full dossier details are available via our API.