142.44.228.25📋 Copy

# IP Intelligence Briefing: 142.44.228.25/32

Classification: Moderate Risk | Severity: Medium

Date: 2026-06-15

Intel Source: IPDebrief Network Intelligence

---

## Executive Summary

IP 142.44.228.25 operates from OVH cloud infrastructure in Beauharnois, Quebec, Canada. The address resolves to aforementioned Ahrefs proxy hostname and exhibits high-abuse neighborhood characteristics. No active malicious indicators detected, but the subnet environment warrants monitoring.

---

## Infrastructure Profile

---

## DNS & Service Analysis

• PTR Hostname: proxy-ca016-san25.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed (1 host)
• Open Ports: None detected
• HTTP/TLS: No services responding
• CAA Records: Present
• DNSSEC: Valid

---

## Threat Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit: No
• Blacklist Count: 0 (profile) | 2 lists (control plane)
• Abuse Confidence: Not assessed
• Campaign Likelihood: None
• Cert Matches: 0
• Banner Matches: 0

---

## Neighborhood Intelligence

Subnet: 142.44.228.0/24

• Abuse Density: 0.6133 (High)
• Classification: high_abuse
• Inherited Risk Score: 24
• Total Siblings: 256
• Active Siblings: 193
• Threat Siblings: 157

Risk Distribution in /24:

• High Risk: 0
• Medium Risk: 81
• Low Risk: 19

---

## Observation History (Recent 20 Signals)

• Abuse Density Signal: 0.6133 (high_abuse classification)
• DNS Resolution: ahrefs.net with CAA records (confidence 0.80)
• ASN/ISP: AS16276, OVH SAS, proxy/VPN type (confidence 0.85)
• DNS Reputation: Minimal score (0.2174)
• Blacklist Status: Listed on 2+ lists with high severity

---

## Network Relationships

• Same Network: 38 relationships (OVH-CUST-281059695)
• Network Stability: Route changes observed in last 30 days (route not stable)
• BGP Prefix: 142.44.128.0/17
• RPKI State: Not assessed

---

## Security Recommendations

Immediate Actions

1. Monitor outbound traffic from this IP for data exfiltration patterns

2. Block inbound connections at perimeter firewall (no legitimate services detected)

3. Monitor for proxy/VPN abuse if this IP is used for outbound traffic

Firewall Rules (iptables/nftables)

```bash

# Block inbound (no legitimate services)

iptables -A INPUT -s 142.44.228.25 -j DROP

# Monitor outbound connections

iptables -A OUTPUT -d 142.44.228.25 -j LOG --log-prefix "OUTBOUND_142.44.228.25: "

```

WAF Rules (Cloudflare/AWS WAF)

• Add to watchlist for proxy/VPN traffic patterns
• Monitor for scanning activity from related IPs

Intelligence Note

The subnet exhibits high abuse density (0.6133) with 157 threat siblings out of 256 total IPs. This IP shares network infrastructure with the OVH customer network. While no direct malicious indicators are present, the neighborhood environment suggests elevated risk. Monitor for correlation with known Ahrefs scraping or SEO-related abuse campaigns.

---

End of Briefing

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.