142.44.233.179📋 Copy

# IP Intelligence Briefing: 142.44.233.179/32

Date: Analysis generated based on available intelligence data

Classification: Moderate Risk (Score: 40/100)

## Executive Summary

IP 142.44.233.179 is a cloud-hosted address belonging to OVH (ASN 16276) under organization Dmytro, Ahrefs Pte Ltd. The address demonstrates moderate risk characteristics with a risk score of 40. The IP resolves to afirewalled domain (ahrefs.net) with no open services detected. The surrounding subnet (142.44.233.0/24) exhibits high abuse density (0.7422), with 190 of 256 sibling IPs flagged as threats.

## Technical Profile

Ownership & Registration:

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network: 142.44.233.0/24
• RIR: ARIN

Geolocation Indicators:

• Country: CA (Canada) / Province: QC
• City: Singapore (data inconsistency noted)
• Geo Confidence: 3000 km radius
• DNSSEC Valid: true

Network Infrastructure:

• Infrastructure Type: CloudCompute
• Hosting Provider: OVH (Cloud hosting confirmed)
• CDN/Proxy/VPN/Tor: Negative indicators
• Service Status: Firewalled / No Services Detected

DNS Analysis:

• PTR Hostname: proxy-ca003-san179.ahrefs.net
• Forward Resolution: proxy-ca003-san179.ahrefs.net (ahrefs.net)
• Email Authentication: SPF and DMARC records absent
• Forward Confirmation: false

Control Plane:

• Origin BGP Prefix: 142.44.128.0/17
• Route Stability: false (route changes detected)
• DNSBL Listings: 1 of 8 total lists
• Operator Score: 0.2174 (Minimal)
• Abuse Confidence Score: Not applicable

## Threat Indicators

Direct Threats:

• Blacklist Count: 0
• Is Tor Exit: false
• Is Known Attacker: false
• Is Spam Source: false
• Known Campaigns: None correlated
• Active Threat Feeds: None

Abuse Metrics:

• Neighborhood Abuse Density: 0.7422 (High)
• Threat Siblings: 190 of 256 IPs in /24 subnet
• Inherited Subnet Risk: 29/100

## Observation History (19 Signals)

Recent observations indicate:

• Subnet abuse density consistently at 0.7422
• High abuse classification maintained
• Geolocation signals show inconsistencies (CA/Singapore mismatch)
• DNSBL listings confirmed in 8 total lists
• One listing with high severity

Temporal analysis shows no persistent malicious behavior patterns (threatPersistenceDays: 0).

## Network Relationships

52 relationships detected, primarily same-network associations (OVH-CUST-281059682). No direct links to external malicious infrastructure identified.

## Recommended Actions

Firewall Blocking Rules:

• iptables: `iptables -A INPUT -s 142.44.233.179 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 142.44.233.179 drop`
• nginx: `deny 142.44.233.179;`
• pfSense: Add 142.44.233.179/32 to block list
• Cloudflare WAF: Block with expression `ip.src eq 142.44.233.179`
• AWS WAF: Add IPSet entry for 142.44.233.179/32

Intelligence-Based Recommendations:

1. Monitor for service activity changes on this IP

2. Consider blocking entire /24 subnet (142.44.233.0/24) if broader threat activity observed

3. Verify ahrefs.net domain ownership and authorization

4. Correlate with other 142.44.233.x addresses if threat activity detected

Risk Assessment:

The IP presents moderate risk primarily due to subnet-level abuse density. While the individual IP shows no direct malicious indicators, the high-abuse neighborhood (74% abuse density) warrants defensive caution. The cloud-hosting nature combined with missing email authentication suggests potential for misuse, though no active threats have been correlated.

Threat Level: Moderate

Recommended Response: Monitor with blocking capability ready

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.