142.44.228.50📋 Copy

## THREAT INTELLIGENCE BRIEFING

Target IP: 142.44.228.50/32

Classification: Moderate Risk (Score: 40)

Date: 2026-06-15

EXECUTIVE SUMMARY

IP 142.44.228.50 is a cloud-hosted infrastructure endpoint associated with OVH SAS (ASN 16276) and organization "Dmytro, Ahrefs Pte Ltd." The IP presents moderate risk with significant geolocation inconsistencies and operates within a high-abuse subnet (142.44.228.0/24). No active services are detected, but DNS association with aresolves hostname indicates potential proxy/firewall usage.

OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 142.44.228.0/24
• Infrastructure Type: Cloud Compute, Hosting
• Network Role: Firewalled / No Services
• Provider Classification: Cloud provider with hosting services

GEOLOCATION ANALYSIS

Critical Finding: Geolocation data shows major inconsistencies requiring investigation.

• Claimed Location: CA, QC, Singapore (contradictory data)
• Coordinates: Latitude 45.4995, Longitude -73.5848 (Quebec, Canada)
• Geolocation Plausibility: FALSE
• RTT Violation: Measured 26ms vs minimum possible 112ms for 5,598km distance
• Validation Status: 5 probe attempts confirmed RTT anomaly
• Assessment: Geolocation spoofing or database corruption detected

THREAT PROFILE

• Risk Score: 40 (Moderate)
• Abuse Confidence: Null
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Blacklist Count: 0
• Threat Feeds: None identified
• Campaign Correlation: None detected

NEIGHBORHOOD RISK ASSESSMENT

Subnet: 142.44.228.0/24

• Abuse Density: 0.6133 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 194
• Threat Siblings: 157
• Inherited Risk Score: 24
• Risk Distribution: 81 Medium, 19 Low, 0 High

The subnet exhibits elevated abuse density with approximately 61% of active IPs flagged as threats.

DNS & NETWORK ASSOCIATIONS

• PTR Hostname: proxy-ca016-san50.ahrefs.net
• Forward Resolution: Confirmed
• DNSSEC: Valid
• CAA Records: Present
• Email Security: No SPF, No DMARC configured
• Forward Hostnames: proxy-ca016-san50.ahrefs.net (1 record)

The hostname pattern suggests proxy infrastructure usage within the Ahrefs network.

OBSERVATION HISTORY

Total Observations: 18

Recent Signal Trends:

• High-abuse classification (0.6133 abuse density)
• Consistent geolocation anomalies
• Minimal operator score (0.2174)
• No persistent threat patterns identified
• Ownership changes: 0

RECOMMENDED ACTIONS

1. Monitor Geolocation Anomalies: The RTT discrepancy (26ms claimed for 5,598km) indicates potential data spoofing. Correlate with known endpoint locations.

2. Subnet Context: Investigate additional 157 threat IPs within the 142.44.228.0/24 block for correlation.

3. Email Security: Host resolves to aresolves.net hostname with no SPF/DMARC. Evaluate for phishing or spoofing risks.

4. Service Monitoring: No open ports detected. Monitor for service emergence.

5. Provider Notification: Consider contacting OVH abuse team if malicious activity confirmed.

INTELLIGENCE SIGNIFICANCE

This IP operates within a high-abuse OVH customer subnet with documented geolocation inconsistencies. The moderate risk classification is driven by neighborhood density rather than direct threat indicators. SOC teams should monitor for lateral threat activity within the associated /24 block and maintain awareness of the geolocation discrepancies for potential spoofing indicators.

---

*Report generated: 2026-06-15 | Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.