142.44.228.245📋 Copy

# IP INTELLIGENCE BRIEFING

Subject: 142.44.228.245/32

Classification: Moderate Risk / Hosting Infrastructure

Date: 2026-06-28

Status: Active Monitoring Required

## EXECUTIVE SUMMARY

IP 142.44.228.245 is a cloud-hosted endpoint within OVH infrastructure (ASN 16276) associated with Ahrefs Pte Ltd. The IP exhibits a moderate risk score (40/100) but operates within a high-abuse density subnet (142.44.228.0/24). Critical geolocation validation failure indicates potential spoofing or misconfiguration. No active threat indicators detected, but contextual factors warrant defensive monitoring.

## NETWORK OWNERSHIP

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH SAS)
• CIDR Block: 142.44.228.0/24
• Provider Type: Cloud Hosting (OVH-CUST-281059695)
• Classification: High Abuse Subnet (abuse density: 0.7422)

## GEOLOCATION VALIDATION FAILURE

The IP reports claimed geolocation as Canada (QC, 45.5075°N, 73.5887°W), but actual probe data confirms location in Singapore. This represents a 5,598 km discrepancy with RTT violations (observed 26-29ms vs. minimum possible 112ms). This geolocation spoofing indicator suggests:

• Potential IP reputation manipulation
• Possible VPN/proxy misconfiguration
• Or legitimate cloud endpoint with incorrect ASN geolocation data

## DNS & HOSTNAME RESOLUTION

• PTR Record: proxy-ca016-san245.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed single hostname
• Email Auth: No SPF, DMARC, or TXT records configured
• Service Status: No open ports detected (firewalled/no services)

## THREAT ASSESSMENT

Current Risk Profile:

• Risk Score: 40/100 (Moderate)
• Operator Score: 0.2174 (Minimal)
• Blacklist Status: Clean (0 blacklists)
• Known Campaigns: None
• Tor/Proxy Status: Not a Tor exit node, not a known proxy

Subnet Context:

• Neighbors analyzed: 100 (out of 256 total)
• Threat siblings: 190 malicious endpoints in subnet
• Risk distribution: 28 medium-risk, 72 low-risk neighbors

## OBSERVATION HISTORY (22 Signals)

Recent activity indicates persistent cloud hosting operations with consistent geolocation mismatches:

• 2026-06-28: RTT violation detected (27ms vs 112ms minimum)
• 2026-06-20: High abuse density classification confirmed (0.7422)
• Persistent signals: Cloud hosting classification, OVH infrastructure

## SECURITY ACTIONS & RECOMMENDATIONS

IMMEDIATE ACTIONS

1. Monitor DNS Activity: Block inbound DNS queries from this IP if not required for legitimate Ahrefs services

2. Rate Limiting: Apply rate limiting to connections from this IP given subnet abuse density

3. Geolocation Filtering: Flag geolocation spoofing attempts in SIEM alerts

FIREWALL RULES

```

# Block direct connection attempts (if not whitelisted)

iptables -A INPUT -s 142.44.228.245/32 -j DROP

# OR Apply rate limiting

iptables -A INPUT -s 142.44.228.245/32 -m limit --limit 5/min --limit-burst 10 -j ACCEPT

iptables -A INPUT -s 142.44.228.245/32 -j DROP

```

NETWORK CLASSIFICATION

• Primary Classification: Cloud Hosting
• Secondary Concern: High-abuse subnet environment
• Threat Level: LOW (no active indicators)

## SOC RECOMMENDATION

Treat as LOW-MEDIUM PRIORITY for monitoring. The IP hosts legitimate Ahrefs infrastructure but operates within a high-abuse OVH subnet with geolocation spoofing. No immediate blocking required, but maintain:

• DNS query logging
• Connection rate monitoring
• Alert on any behavior deviation from normal hosting patterns

Next Review: 30 days or upon threat indicator emergence

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.