142.44.228.40📋 Copy

# IP INTELLIGENCE BRIEFING

IP Address: 142.44.228.40/32

Report Date: 2026-06-26

Classification: Cloud Infrastructure / Hosting Provider Network

---

## EXECUTIVE SUMMARY

IP 142.44.228.40 is a cloud compute instance hosted on OVH SAS infrastructure, registered under entity "Dmytro, Ahrefs Pte Ltd." The IP demonstrates a low-risk reputation score of 30 but operates within a high-abuse density subnet (142.44.228.0/24) with 70.31% abuse density. No active threat indicators were detected at time of analysis.

---

## RISK PROFILE

Threat Indicators: None detected. IP is not classified as Tor exit node, known attacker, or spam source. Blacklist count: 0.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: AS16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network: OVH-CUST-281059695
• RIR: ARIN
• Infrastructure Type: Cloud Compute / Hosting
• CIDR Block: 142.44.228.0/24

Geolocation Discrepancy: Reported location indicates Canada (CA, QC, Singapore region) with coordinates showing 5,597.9km distance. RTT measurements (25-35ms) suggest actual proximity inconsistent with claimed geolocation. This indicates potential spoofing or routing anomalies.

---

## DNS & SERVICE ANALYSIS

Reverse DNS: proxy-ca016-san40.ahrefs.net

Forward Resolution: Confirmed single hostname

Domain: ahrefs.net

Services: No open ports detected (firewalled/no services)

Email Security: SPF: Not configured, DMARC: Not configured

Note: Domain association with ahrefs.net suggests legitimate SEO tools infrastructure, but hostname pattern suggests proxy/gateway function.

---

## NETWORK CONTEXT

Subnet Analysis (142.44.228.0/24):

• Total Siblings: 256 IPs
• Active Siblings: 228 (89% utilization)
• Abuse Density: 70.31% (High Abuse Classification)
• Inherited Risk: 28
• Risk Distribution: 0 High, 67 Medium, 33 Low

Control Plane:

• BGP Prefix: 142.44.128.0/17
• AS Path: 57866 → 16276
• RPKI State: Valid
• Route Stability: Stable (0 changes in 30 days)
• DNSBL Lists: 1/8 lists

---

## OBSERVATION HISTORY

Total Observations: 28 signals

Recent Activity (June 26, 2026):

• Threat signals detected (confidence: 0.75)
• AlienVault OTX feed reports threats
• RPKI/Operator validation signals present

Historical Context (June 22, 2026):

• Infrastructure classification confirmed as OVH hosting
• Multiple geolocation validation failures recorded
• Consistent RTT violations indicating location spoofing

Temporal Assessment: Single threat observation event. Not classified as persistently malicious.

---

## RELATIONSHIP NETWORK

Total Relationships: 57 entities linked

Primary Connections:

• 52+ "Same Network" relationships to OVH-CUST-281059695 network
• Consistent provider-level association with OVH infrastructure

No certificate matches, campaign correlations, or external organization links identified.

---

## SECURITY RECOMMENDATIONS

Current Risk Assessment: Low threat (Score: 30), but contextually elevated due to high-abuse subnet environment.

Recommended Actions:

1. Monitor: Continue passive monitoring; no immediate blocking required

2. Contextualize: Correlate with other subnet activity when assessing threats

3. Geolocation Validation: Flag for review due to location/RTT inconsistencies

4. Email Policies: Consider SPF/DMARC configuration if used for email services

Firewall Rules: No specific firewall rules generated (risk score below threshold for automated action)

---

## CONCLUSION

IP 142.44.228.40 represents legitimate cloud infrastructure within a high-density hosting environment. While the IP itself shows low-risk characteristics, operational context requires awareness of:

• High-abuse subnet environment (70.31% abuse density)
• Geolocation inconsistencies requiring validation
• Association with ahrefs.net domain infrastructure

Threat Level: LOW – Monitor but no immediate action required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.