142.44.228.37📋 Copy

## IP Intelligence Briefing: 142.44.228.37/32

Classification: Moderate Risk | Risk Score: 40 | Provider: OVH

Executive Summary

IP 142.44.228.37 is a cloud infrastructure address registered to Dmytro/Ahrefs Pte Ltd under OVH hosting (ASN 16276). The IP shows moderate risk with significant neighborhood abuse density. Geolocation data indicates physical impossibility violations requiring validation.

---

Ownership and Network Classification

• Organization: Dmytro, Ahrefs Pte Ltd
• Netname: OVH-CUST-281059695
• CIDR Block: 142.44.228.0/24
• Infrastructure Type: CloudCompute / Hosting
• AS Path: 16276
• Registration: ARIN

Threat Indicators

• Blacklist Status: 0 entries detected
• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False
• Known Campaigns: None identified
• Threat Feeds: No active threat feed indicators

DNS and Service Analysis

• PTR Hostname: proxy-ca016-san37.ahrefs.net
• Forward Resolution: Unconfirmed (forward confirmed: false)
• HTTP Title: No services detected (Firewalled/No Services)
• Open Ports: None observed
• Email Authentication: No SPF, DMARC, or TXT records configured

Geolocation Anomalies

• Reported Location: Singapore (QC region, CA country code)
• Physical Distance: 5,598 km from probe
• Minimum Possible RTT: 112ms
• Observed RTT: 29ms
• Status: VIOLATION - Observed RTT is physically impossible for reported distance, indicating potential spoofing or data inconsistency requiring validation.

Neighborhood Analysis (/24 Subnet)

• Abuse Density: 0.6328 (High Abuse classification)
• Total Siblings: 256
• Active Siblings: 194
• Threat Siblings: 162
• Inherited Risk: 25
• Risk Distribution: 81 medium-risk, 19 low-risk neighbors

Historical Observations

• Total Signals: 18 observations
• Threat Persistence: 0 days (transient activity)
• Ownership Changes: 0
• Recent Signals:

- 2026-06-15: Subnet abuse density 0.6328 (high_abuse classification)

- 2026-06-15: Operator score 0.2174 (Minimal)

- 2026-06-09: No persistent malicious activity detected

Recommended Actions

Based on risk profile and neighborhood context, the following blocking rules are recommended:

Immediate Blocking (iptables/nftables):

```

iptables -A INPUT -s 142.44.228.37 -j DROP

nft add rule inet filter input ip saddr 142.44.228.37 drop

```

Web Application Firewall:

```nginx

deny 142.44.228.37;

```

Cloud Provider:

```

AWS WAF: Block 142.44.228.37/32

Cloudflare WAF: ip.src eq 142.44.228.37

```

Intelligence Assessment

The IP demonstrates moderate risk within a high-abuse neighborhood. The geolocation RTT violation is anomalous and warrants additional investigation. No active threat indicators are present, but the surrounding subnet shows elevated abuse rates. Recommend blocking while monitoring for correlation with other known malicious infrastructure.

---

Report Generated: IPDebrief Intelligence Platform

Data Source: IPDebrief Signal Observatory

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.