142.44.228.75📋 Copy

## IP Intelligence Briefing: 142.44.228.75/32

Classification: LOW RISK WITH CONTEXTUAL CONCERNS

Analysis Date: Current

IP Address: 142.44.228.75

---

Executive Summary

IP 142.44.228.75 presents as a legitimate cloud infrastructure endpoint with a Low Risk score (35). However, it resides within a high-abuse density subnet (142.44.228.0/24), which contains 148 identified threat siblings among 254 total IPs. The IP is associated with Ahrefs through DNS records but hosted on OVH infrastructure.

---

Ownership and Infrastructure

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• Network: OVH-CUST-281059695
• Infrastructure Type: CloudCompute / Hosting
• Registration: RIR ARIN, RIPE registry delegated

The IP resolves to hostname `proxy-ca016-san75.ahrefs.net`, indicating association with Ahrefs.net infrastructure. Control plane analysis confirms valid RPKI validation and stable BGP routing.

---

Geolocation Assessment

• Country: Canada (CA)
• Region: Quebec (QC)
• City: Singapore (notable discrepancy detected)
• Geographic Consensus: Mixed sources (CA country code vs Singapore city)
• Accuracy Radius: 3000km

The geographic inconsistency warrants monitoring but does not indicate active compromise.

---

Threat Indicators

• Risk Score: 35 (Low Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Status: 0 blacklists (DNSBL: 2/8 lists)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Campaigns: None detected
• Known Threat Feeds: Empty

Current threat indicators are absent. The IP is not flagged as actively malicious.

---

Neighborhood Context

The /24 subnet (142.44.228.0/24) exhibits elevated abuse characteristics:

• Abuse Density: 0.5827 (High Abuse classification)
• Threat Siblings: 148 of 254 IPs flagged as threats
• Active Siblings: 176 IPs currently observed
• Inherited Risk: 23 (derived from subnet context)

Neighboring IPs show risk distribution: 81 medium risk, 19 low risk, 0 high risk.

---

Services and DNS

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• Service Purpose: Firewalled / No Services
• Forward Resolution: proxy-ca016-san75.ahrefs.net
• DNS Records: CAA present, IRR match, DNSSEC valid

No active services detected on the endpoint, indicating firewall protection or inactive state.

---

Historical Observation

28 observations tracked over the monitoring period. Recent signals include:

• Professional operator routing score (0.9)
• Consistent DNS resolution to ahrefs.net
• Stable ownership and geolocation signals
• No persistent malicious activity detected

---

Recommended Actions

Immediate:

• No blocking required; risk score supports continued connectivity
• Monitor for service activation

Long-term:

• Implement egress filtering if outbound traffic is observed
• Monitor subnet context for correlated abuse campaigns
• Review DNSBL listings (2/8 lists) for policy considerations

Firewall Rules:

• Allow inbound if legitimate Ahrefs services expected
• Monitor for port scan activity
• Consider subnet-level monitoring given high-abuse classification

---

Analyst Notes: This IP represents legitimate Ahrefs infrastructure operating in a shared OVH hosting environment. The low individual risk score combined with the high-abuse subnet context suggests infrastructure sharing rather than active compromise. Continue monitoring for service activation or behavioral anomalies.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.