142.44.228.228📋 Copy

# INTELLIGENCE BRIEFING: 142.44.228.228/32

Classification: MODERATE RISK — Cloud Infrastructure with High-Abuse Neighborhood

---

## EXECUTIVE SUMMARY

IP 142.44.228.228 is assigned to OVH cloud infrastructure under organization "Dmytro, Ahrefs Pte Ltd" (ASN 16276). The address resolves to hostname proxy-ca016-san228.ahrefs.net and operates within a high-abuse density subnet (142.44.228.0/24) with 65.62% abuse classification. The IP presents moderate risk (score 40) with no open services detected and zero known malicious indicators.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 142.44.228.0/24
• Infrastructure Type: CloudCompute (OVH hosting provider)
• Registration: RIR-ARIN, no public registration date available
• Network Role: Hosting-enabled, firewalled configuration with no open ports

---

## GEOLOCATION ANALYSIS

• Reported Country: CA (Canada)
• Reported City: Singapore
• Geolocation Consensus: FALSE
• Validity Flag: geoPlausible = false
• RTT Violation: 31ms measured vs. 112ms minimum possible for 5,598km distance (significant data inconsistency)
• Recommendation: Treat geolocation as unreliable; treat as North American hosting infrastructure

---

## THREAT INDICATORS

• Risk Score: 40/100 (Moderate Risk)
• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not available
• Threat Feeds: Empty

---

## DNS & HOSTNAME RESOLUTION

• PTR Hostname: proxy-ca016-san228.ahrefs.net
• Forward Confirmed: No
• Domain: ahrefs.net
• Reverse DNS: Single entry, no forward confirmation
• Email Authentication: No SPF/DMARC records detected
• TLS Services: None detected

---

## NEIGHBORHOOD ANALYSIS (142.44.228.0/24)

• Subnet Classification: HIGH_ABUSE
• Abuse Density: 65.62%
• Total Subnet IPs: 256
• Active IPs: 205
• Threat IPs: 168
• Risk Distribution: High (0), Medium (79), Low (21)

Assessment: This /24 subnet exhibits elevated abuse activity. The target IP shares infrastructure with 168 previously observed threat siblings.

---

## OBSERVATION HISTORY

• Total Observations: 19 signals
• Latest Signal (2026-06-15): Operator score 0.2174, Minimal classification
• DNS Resolution (2026-06-10): Confirmed ahrefs.net domain with CAA records present
• Campaign Correlation: No correlated IPs or certificate matches
• Persistence: 0 threat persistence days, 0 ownership changes

---

## CONTROL PLANE DATA

• Origin ASN: 16276
• BGP Prefix: 142.44.128.0/17
• Route Stability: False
• RPKI State: Not available
• DNSSEC: Valid
• DNSBL Listings: 1 of 8 total lists
• Operator Score: 0.2174 (Minimal)

---

## RECOMMENDED ACTIONS

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 142.44.228.228 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.228.228 drop

# nginx

deny 142.44.228.228;

# pfSense

142.44.228.228/32

# Cloudflare WAF

ip.src eq 142.44.228.228 → BLOCK

# AWS WAF

Addresses: 142.44.228.228/32 → BLOCK

```

---

## ANALYST NOTES

1. Infrastructure Context: IP operates under Ahrefs domain but lacks forward DNS confirmation. The proxy-ca016-san228 hostname suggests internal proxy infrastructure.

2. Abuse Context: The /24 subnet's 65.62% abuse density warrants caution. Even though this specific IP lacks active threat indicators, the neighborhood context elevates overall risk.

3. Cloud Environment: Hosting classification with no open services indicates either properly secured infrastructure or intentionally firewalled systems.

4. Monitoring Recommendation: Monitor for service discovery or port opening activity given the high-abuse neighborhood context.

---

Briefing Generated: 2026-06-15

Data Source: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.