142.44.228.6📋 Copy

# IP INTELLIGENCE BRIEFING: 142.44.228.6/32

Classification: Moderate Risk / Cloud Infrastructure / OVH Hosting

---

## EXECUTIVE SUMMARY

IP address 142.44.228.6 is a cloud computing endpoint hosted on OVH infrastructure (AS16276) under customer block OVH-CUST-281059695. The IP is associated with Ahrefs domain infrastructure but presents moderate risk (Score: 50) with evidence of geolocation spoofing and network instability. The subnet exhibits high abuse density with 67.97% classification. Recommended action: Block at perimeter firewall pending correlation with additional threat indicators.

---

## INFRASTRUCTURE PROFILE

---

## THREAT INDICATORS

Active Indicators:

• Geolocation spoofing detected (claimed: Canada/Quebec; actual RTT indicates Singapore region, 5,597.9km distance)
• RTT violation: 27ms observed vs 112ms minimum expected for claimed location
• DNSBL listings: 2 of 8 total blacklists (0.2174 operator score)
• Route instability flagged in control plane data
• 174 of 256 sibling IPs in /24 classified as threats (68% threat ratio)

Historical Signals (21 observations):

• June 20, 2026: ASN AS16276 OVH SAS confirmed; cloud infrastructure verified
• June 20, 2026: Geolocation mismatch with 5,597.9km distance
• June 28, 2026: Threat indicators detected; 1 pulse in AlienVault OTX

---

## NETWORK RELATIONSHIPS

---

## SUBNET CONTEXT (142.44.228.0/24)

---

## RECOMMENDED ACTIONS

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 142.44.228.6 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.228.6 drop

# pfSense

142.44.228.6/32 (Block)

```

Cloud/CDN Integration:

• Cloudflare WAF: Block IP (expression: `ip.src eq 142.44.228.6`)
• AWS WAF: Add 142.44.228.6/32 to deny list

---

## ANALYST NOTES

• Geolocation Validation: Fails RTT plausibility check. IP claims Canadian location but RTT measurements indicate 5,597.9km distance, suggesting spoofed or inaccurate geo-data.
• Subnet Risk: High abuse density in /24 (68% threat ratio) warrants monitoring of adjacent IPs.
• Infrastructure: No open ports or active services detected. IP is firewalled.
• DNS Context: PTR hostname resolves to Ahrefs infrastructure (proxy-ca016-san6.ahrefs.net). Legitimate web crawler or SEO tool endpoint possible.
• Action Priority: Moderate. Block at perimeter but maintain visibility for threat hunting correlation.

---

Generated: IPDebrief Intelligence Analysis

Classification: SOC-Use Only

Version: 1.0

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.