142.44.228.41📋 Copy

INTELLIGENCE BRIEFING: 142.44.228.41

Classification: Moderate Risk | Risk Score: 40/100

---

SUMMARY

IP 142.44.228.41 is a hosting infrastructure address associated with OVH (ASN 16276) and registered under Dmytro, Ahrefs Pte Ltd (Netname: OVH-CUST-281059695). The IP exhibits moderate risk characteristics with a high-abuse neighborhood profile. Geolocation validation failed due to significant RTT anomalies, suggesting the claimed Canadian location is inaccurate.

OWNERSHIP & INFRASTRUCTURE

• Organization: Dmytro, Ahrefs Pte Ltd
• Provider: OVH
• ASN: 16276
• CIDR Block: 142.44.228.0/24
• DNS: proxy-ca016-san41.ahrefs.net (ahrefs.net domain)
• Network Role: Hosting infrastructure, firewalled with no open services detected

THREAT INTELLIGENCE

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence: Not flagged as known attacker, spam source, or Tor exit
• Blacklist Status: 0 explicit blacklists, 1 DNSBL listing out of 8 total lists scanned
• Threat Persistence: Single observation, not persistently malicious
• Campaign Correlation: No known campaign matches

GEOSPATIAL ANOMALY

• Claimed Location: Canada (QC)
• Inferred Location: Singapore (5,598 km from claimed position)
• RTT Violation: 26ms observed vs. 112ms minimum possible for distance
• Geolocation Consensus: False (5 probes, 100% violation rate)

NEIGHBORHOOD ANALYSIS (142.44.228.0/24)

• Abuse Density: 60.55% (High Abuse Classification)
• Active Siblings: 189/256
• Threat Siblings: 155
• Risk Distribution: 81 medium-risk, 19 low-risk, 0 high-risk neighbors
• Subnet Risk Level: Elevated due to concentration of abuse indicators

OBSERVATION HISTORY

• Total Observations: 21
• Recent Activity: Consistent high-abuse classification (0.6055 density)
• Threat Signal Count: 1
• Stability: Moderate risk profile maintained across observation window

---

RECOMMENDED ACTIONS

SOC Analyst Guidance: Monitor or block based on risk tolerance. The subnet shows significant abuse concentration.

Firewall Rules:

• iptables: `iptables -A INPUT -s 142.44.228.41 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 142.44.228.41 drop`
• Cloudflare WAF: Block with expression `ip.src eq 142.44.228.41`
• AWS WAF: Add address `142.44.228.41/32`

NOTE: Actions are probabilistic recommendations. Combine with additional signals before enforcement.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.