142.44.228.225📋 Copy

# IP Intelligence Briefing: 142.44.228.225

## Executive Summary

IP address 142.44.228.225 is a low-risk (score: 25) cloud compute endpoint registered to OVH SAS (ASN 16276). The IP is associated with Ahrefs Pte Ltd infrastructure and resolves to the ahrefs.net domain. While the endpoint itself shows minimal malicious indicators, geolocation inconsistencies and moderate neighborhood abuse density warrant continued monitoring.

---

## Profile Overview

---

## Key Findings

DNS and Service Activity

• PTR Record: proxy-ca016-san225.ahrefs.net
• Hosted Domain: ahrefs.net
• Open Ports: None detected
• HTTPS/TLS: No certificates or HTTP services observed
• Forward Resolution: Confirmed to ahrefs.net hostname

Geolocation Analysis

⚠️ Anomalies Detected:

• Multiple geolocation sources report conflicting data (Canada vs. Singapore)
• RTT Violation: 25ms RTT reported against 112ms minimum expected for 5,598km distance
• This suggests possible geolocation spoofing or routing anomalies

Network Classification

• Cloud Provider: OVH
• Hosting: Yes
• Cdn/Proxy/VPN: No
• Tor Exit Node: No
• Residential: No

---

## Neighborhood Assessment

Subnet: 142.44.228.0/24

• Total Siblings: 256
• Active Siblings: 228
• Threat Siblings: 112
• Abuse Density: 0.4375 (Moderate)
• Classification: Mixed

Risk Distribution in Subnet:

• High Risk: 0
• Medium Risk: 63
• Low Risk: 37

The /24 subnet exhibits moderate abuse activity with 112 threat-siblings. The target IP resides in a generally mixed-risk environment with no high-risk neighbors immediately adjacent.

---

## Historical Observations

Total Signals: 21 observations

• Most recent signal: 2026-06-25 (subnet classification and abuse density)
• No persistent malicious activity detected
• Threat observation count: 1
• Ownership changes: 0

Historical data indicates stable ownership with no significant risk escalation over the observation period.

---

## Relationships

Total Relationships: 53

• Primary: Same network associations (OVH-CUST-281059695)
• External Correlations: Limited cross-domain or cross-ASN relationships
• No known campaign associations or certificate matches

---

## Threat Indicators

• Blacklist Count: 0
• Known Campaigns: None
• Threat Feeds: None active
• Abuse Confidence: Not applicable (low risk)

---

## Recommended Actions

No immediate defensive actions required at this risk level. The IP profile indicates legitimate cloud infrastructure with no active threat indicators.

SOC Analyst Notes:

• Monitor for geolocation spoofing anomalies during traffic analysis
• Consider correlation with ahrefs.net domain reputation
• Maintain awareness of subnet-level abuse trends (0.4375 density)
• No firewall rules recommended based on current risk profile

---

## Conclusion

IP 142.44.228.225 represents legitimate cloud infrastructure operated by OVH for Ahrefs. The low risk score and absence of threat indicators support continued monitoring rather than blocking. The geolocation inconsistency should be noted for traffic analysis but does not indicate active compromise. The moderate neighborhood abuse density suggests maintaining awareness of broader subnet activity.

Classification: LOW RISK - Legitimate Cloud Infrastructure

Priority: Standard Monitoring

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.