142.44.233.121
## IP INTELLIGENCE BRIEFING: 142.44.233.121/32
Classification: Moderate Risk – Cloud Infrastructure
Generated: 2026-06-28
---
EXECUTIVE SUMMARY
IP 142.44.233.121 is a moderate-risk (40/100) cloud computing endpoint hosted on OVH infrastructure in Canada. The IP resolves to the legitimate domain ahrefs.net but operates within a high-abuse density subnet (/24) showing 74.61% abuse classification. No direct threat indicators detected, but neighborhood context suggests elevated risk environment.
---
INFRASTRUCTURE PROFILE
| Attribute | Value |
|---|---|
| **IP Address** | 142.44.233.121 |
| **Organization** | Dmytro, Ahrefs Pte Ltd |
| **ASN** | 16276 (OVH) |
| **Network** | OVH-CUST-281059682 |
| **CIDR Block** | 142.44.233.0/24 |
| **Country** | Canada (QC – Beauharnois) |
| **Infrastructure Type** | CloudCompute |
| **Provider** | OVH |
| **Risk Score** | 40 (Moderate) |
---
DNS & HOSTING ANALYSIS
- PTR Hostname: proxy-ca003-san121.ahrefs.net
- Forward Resolution: proxy-ca003-san121.ahrefs.net (confirmed)
- Associated Domain: ahrefs.net (legitimate SEO analytics platform)
- Service Status: No open ports detected – service marked as "Firewalled / No Services"
- Email Auth: No SPF/DMARC records detected on associated domain
---
THREAT INDICATORS
| Indicator | Status |
|---|---|
| Known Attacker | No |
| Spam Source | No |
| Tor Exit Node | No |
| Proxy Service | No |
| Blacklist Count | 0 |
| DNSBL Listed | 1/8 lists |
| Max List Severity | High |
| Known Campaigns | None |
Threat Signal History: 24 observations recorded. Most recent signals (June 2026) confirm cloud infrastructure hosting and DNS blacklist presence with high severity classification.
---
NEIGHBORHOOD ANALYSIS
The /24 subnet (142.44.233.0/24) exhibits elevated abuse activity:
| Metric | Value |
|---|---|
| **Subnet Abuse Density** | 0.7461 (High) |
| **Threat Siblings** | 191/256 (74.6%) |
| **Active Siblings** | 207 |
| **Inherited Risk** | 29 |
| **Risk Distribution** | High: 0, Medium: 96, Low: 4 |
Assessment: Subnet shows concentrated abuse activity with 74.6% of sibling IPs classified as threats. This suggests shared infrastructure usage with potential for abuse or compromised accounts.
---
GEOGRAPHIC VALIDATION
- Reported Location: Canada, Quebec, Beauharnois
- Geographic Consensus: Inconsistent (geoPlausible: false)
- RTT Anomaly: 26ms average RTT for 5,598km distance
- Minimum Possible RTT: 112ms
- Probe Count: 5
- Status: Geographic data shows significant RTT violation, indicating potential routing manipulation or misreported location.
---
NETWORK CLASSIFICATION
| Flag | Status |
|---|---|
| Is Cloud | Yes |
| Is Hosting | Yes |
| Is CDN | No |
| Is VPN | No |
| Is Proxy | No |
| Is Tor | No |
| Is Residential | No |
| Is Mobile | No |
| Is Bogon | No |
| Is Anycast | No |
Control Plane: Route changes recorded (0 in 30 days), origin ASN 16276, BGP prefix 142.44.128.0/17.
---
RECOMMENDED ACTIONS
| Platform | Action |
|---|---|
| **Firewall (iptables)** | `iptables -A INPUT -s 142.44.233.121 -j DROP` |
| **Firewall (nftables)** | `nft add rule inet filter input ip saddr 142.44.233.121 drop` |
| **Nginx** | `deny 142.44.233.121;` |
| **pfSense** | `142.44.233.121/32` |
| **Cloudflare WAF** | Block (risk score 40) |
| **AWS WAF** | Add to blocklist |
Recommendation: Block this IP due to moderate risk score combined with high-abuse neighborhood classification. Monitor for any legitimate traffic from ahrefs.net domain before implementing permanent blocks.
---
ANALYST NOTES
- IP resolves to legitimate ahrefs.net domain infrastructure
- No direct malicious indicators detected on this specific endpoint
- Elevated risk from subnet-level abuse activity (191 threat siblings)
- Geographic data inconsistencies warrant further investigation if traffic patterns suggest misattribution
- Recommended action is preventive blocking until legitimacy can be confirmed via additional correlation with known ahrefs.net IP ranges
---
END OF BRIEFING
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Dmytro, Ahrefs Pte Ltd |
| ASN | AS16276 |
| Network Name | OVH-CUST-281059682 |
| CIDR Block | 142.44.233.0/24 |
| RIR | ARIN |
| Country | Singapore |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | proxy-ca003-san121.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-ca003-san121.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 30% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 30% | 2 | 3 |
| ownership | 12% | 2 | 2 |
| reputation | 28% | 1 | 3 |
| geolocation | 39% | 2 | 3 |
| Overall | 25% | 10 | 15 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-17 09:09:31 UTC |
| Last Seen | 2026-06-28 04:47:44 UTC |
| Profile Built | 2026-06-28 22:53:22 UTC |
| Data Freshness | Live |
| Signal Types | 23 |
| Total Observations | 29 |
Full dossier details are available via our API.