142.44.228.5📋 Copy

# Intelligence Briefing: 142.44.228.5/32

## Executive Summary

The IP address 142.44.228.5/32 is a low-risk infrastructure endpoint hosted on OVH cloud infrastructure (ASN 16276) within the 142.44.228.0/24 subnet. While classified as "Low Risk" with a risk score of 25, the address exhibits several anomalous characteristics including geolocation inconsistencies, DNS resolution to Ahrefs proxy infrastructure, and neighborhood-level elevated threat indicators.

## Infrastructure Profile

Ownership: The IP resolves to ASN 16276 (OVH SAS) under the network prefix OVH-CUST-281059695. The associated organization is registered to "Dmytro, Ahrefs Pte Ltd."

Geolocation: The address reports a Canadian location (QC) with coordinates at latitude 45.4995, longitude -73.5848. However, geolocation validation flagged a significant discrepancy: measured RTT (28ms) is substantially lower than the minimum physically plausible RTT (112ms) for the claimed distance of 5,598km from probe location, resulting in a "geo_plausible: false" status.

DNS: The PTR record resolves to proxy-ca016-san5.ahrefs.net within the ahrefs.net domain. Forward DNS resolution confirmed, though forward-confirmed status is false.

Services: No open ports detected; the endpoint is firewalled with no active HTTP/TLS services.

## Threat Assessment

Risk Classification: Low Risk (Score: 25)

Threat Indicators:

• No known campaigns or threat feed matches
• Not identified as Tor exit node, known attacker, or spam source
• Zero blacklist entries detected
• Pulsedive risk score: null

Abuse Context: The address shows abuse confidence score as null, but the subnet exhibits notable activity patterns.

## Neighborhood Analysis

The IP resides in subnet 142.44.228.0/24 with the following characteristics:

• Total siblings: 256 IPs
• Active siblings: 228
• Threat siblings: 112
• Abuse density: 0.4375 (43.75%)
• Inherited risk: 17

Neighbor analysis of 100 sampled addresses in the /24 subnet revealed a risk distribution of 0 high-risk, 64 medium-risk, and 36 low-risk addresses. Multiple neighbor IPs (142.44.228.0 through 142.44.228.4) consistently returned risk scores of 40 with authority scores of 50, suggesting elevated neighborhood-level activity.

## Historical Signals

Observation history captured 20 signals with the following key observations:

• Recent threat detection signal (confidence 0.75) on 2026-06-26T00:10:57Z flagged with `has_threats: true` and pulse count of 1
• Abuse density signal (confidence 0.75) confirming subnet classification as "mixed" with inherited risk of 17
• Geolocation violation signals (confidence 0.30-0.75) indicating RTT/latency inconsistencies
• Operator score signal showing "Minimal" classification with raw score of 0.1

## Network Relationships

The IP maintains 54 documented relationships, primarily consisting of "Same Network" entries linking to OVH-CUST-281059695. No additional organizational, hostname, or certificate relationships were populated in the relationship graph.

## Control Plane & Routing

• BGP prefix: 142.44.128.0/17
• Origin ASN: 16276
• Route stability: False (isRouteStable: false)
• Route changes (30d): 0
• RPKI/Irr: Not validated/consistent
• DNSSEC: Valid
• DNSBL listings: 1 of 8 total lists (dnsblListedCount: 1)

## Recommended Actions

Based on the IP's low-risk profile and current threat indicators, no specific firewall or mitigation rules were generated. The address remains in a low-risk category (score 25), but SOC analysts should monitor for:

1. Geolocation anomaly correlation with legitimate traffic patterns

2. Subnet-level threat activity given the 43.75% abuse density

3. DNS activity to ahrefs.net proxy infrastructure

## Conclusion

IP 142.44.228.5 represents a low-risk OVH-hosted endpoint with anomalous geolocation reporting and DNS resolution to Ahrefs proxy infrastructure. While individual threat indicators are minimal, the subnet exhibits elevated abuse density (43.75%) with 112 threat-classified siblings. Continued monitoring of neighborhood-level activity and geolocation consistency is recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.