142.44.233.234📋 Copy

# IPDebrief Intelligence Briefing

Target IP: 142.44.233.234/32

Classification: Moderate Risk (Score: 40)

Report Date: 2026-06-28

Prepared For: SOC Analyst Team

---

## Executive Summary

IP 142.44.233.234 is a moderate-risk address associated with OVH CloudCompute infrastructure. The IP resolves to a hosted domain (ahrefs.net) and is part of an OVH-CUST-281059682 network block. Despite no active open ports, the IP has been listed on 8 DNSBL threat lists, including 1 listing at high severity. The /24 subnet (142.44.233.0/24) shows elevated abuse density (0.7539) with 193 of 256 total IPs flagged as threats.

---

## Infrastructure Profile

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: AS16276 (OVH SAS)
• Network: OVH-CUST-281059682
• CIDR Block: 142.44.233.0/24
• Geolocation: Canada, Quebec, Beauharnois (3000km accuracy radius)
• Infrastructure Type: Cloud Compute / Hosting
• Network Role: Firewalled / No Services Detected
• DNS PTR: proxy-ca003-san234.ahrefs.net

---

## Threat Indicators

• Risk Score: 40 (Moderate)
• DNSBL Listings: 8 total, 1 at high severity
• Known Campaigns: None correlated
• Tor Exit/Proxy: False
• Spam Source: Not flagged
• Known Attacker: Not flagged

Notable Anomaly: Geographic validation shows RTT violation (28ms measured vs. minimum possible 112ms for 5,597.9km distance from probe location).

---

## Neighborhood Analysis

The /24 subnet exhibits high_abuse classification:

• Abuse Density: 0.7539
• Total Siblings: 256
• Active Siblings: 210
• Threat Siblings: 193
• Risk Distribution: 0 high-risk, 96 medium-risk, 4 low-risk

The subnet demonstrates concentrated malicious activity, with 75% of IPs classified as threats.

---

## Historical Activity

Signal observation history reveals 22 observations. Key signals include:

• 2026-06-28: Listed on 8 threat lists (high severity)
• 2026-06-20: Subnet abuse density confirmed at 0.7539
• 2026-06-20: ASN AS16276 (OVH) flagged with threat indicators

The IP shows persistent association with hosting infrastructure and maintains consistent network relationships with the OVH-CUST-281059682 network block.

---

## Related Entities

49 relationships identified, all mapped to the same network (OVH-CUST-281059682). No external organizational or certificate relationships detected beyond the hosting network.

---

## Recommended Actions

Based on risk profile and threat indicators:

Firewall Rules:

```

# iptables

iptables -A INPUT -s 142.44.233.234 -j DROP

# nftables

nft add rule inet filter input ip saddr 142.44.233.234 drop

# nginx

deny 142.44.233.234;

# pfSense

142.44.233.234/32

# Cloudflare WAF

ip.src eq 142.44.233.234 → BLOCK

# AWS WAF

Addresses: 142.44.233.234/32

```

---

## Analyst Notes

• While the IP is associated with Ahrefs (legitimate SEO analytics company), the presence on 8 DNSBL lists and high-severity listings warrants defensive blocking
• The subnet's elevated abuse density suggests potential abuse of OVH hosting infrastructure by malicious actors
• Consider blocking the entire /24 subnet (142.44.233.0/24) if false-positive tolerance is acceptable
• No active services detected, which may indicate the IP is being used for header-only attacks or as part of a distributed infrastructure

---

Data Sources: IPDebrief Intelligence Platform

Confidence Level: High (multiple corroborating signals)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.