142.44.233.240📋 Copy

# IP Intelligence Briefing: 142.44.233.240/32

Date: 2026-06-17

Classification: Moderate Risk

Analyst: IPDebrief Intelligence Platform

---

## Executive Summary

IP address 142.44.233.240 presents a moderate risk profile (Risk Score: 40/100). The address is associated with OVH hosting infrastructure and shows evidence of high-abuse subnet density. No active open services detected. Geolocation validation discrepancies observed.

---

## Infrastructure Profile

Network Assignment:

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 142.44.233.0/24
• Infrastructure Type: Hosting/Cloud Provider

DNS Configuration:

• PTR Record: proxy-ca003-san240.ahrefs.net
• Forward Resolution: Confirmed (ahrefs.net)
• Email Authentication: No SPF/DMARC records configured
• Forward Hostnames: proxy-ca003-san240.ahrefs.net

---

## Threat Indicators

Current Risk Assessment:

• Overall Risk Score: 40 (Moderate)
• Abuse Confidence: Not scored
• Blacklist Status: 0 blacklist entries
• DNSBL Listing: 1 of 8 total lists (dnsblListedCount)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

Control Plane Data:

• Operator Score: 0.2174 (Minimal)
• BGP Prefix: 142.44.128.0/17
• Route Stability: False
• RPKI State: Not evaluated
• DNSSEC Valid: True

---

## Neighborhood Analysis

Subnet: 142.44.233.0/24

• Total Siblings: 256 IPs
• Active Siblings: 206 IPs
• Threat Siblings: 196 IPs (76.56% abuse density)
• Inherited Risk: 30/100
• Subnet Classification: High Abuse

Risk Distribution in Subnet:

• High Risk: 0 IPs
• Medium Risk: 94 IPs
• Low Risk: 6 IPs

The subnet demonstrates elevated abuse activity, with approximately 76.6% of IPs classified as threat siblings.

---

## Geolocation Analysis

Claimed Location:

• Country: CA (Canada)
• Region: QC
• City: Singapore

Validation Status: ⚠️ INVALID

• Distance: 5,597.9 km
• Observed RTT: 27.0ms
• Minimum Possible RTT: 112.0ms
• Status: Violation (RTT 27ms < minimum possible 112ms for 5,598km distance)

The geolocation data is implausible, indicating potential spoofing or misconfiguration.

---

## Observation History

Total Observations: 23

Recent Signals (2026-06-17):

1. Subnet Abuse Density: 0.7656 (High Abuse Classification) - Confidence: 0.75

2. Campaign Analysis: None detected - Confidence: 0.30

3. Geolocation Validation: Implausible RTT violation - Confidence: 0.30

4. Operator Score: 0.2174 (Minimal) - Confidence: 0.60

5. Overall Profile: 13 dimensions covered, 6 data sources - Confidence: 0.2442

---

## Service Exposure

Open Ports: None detected

Service Status: Firewalled / No Services

HTTP Banner: None

TLS Certificate: None

HTTP Title: None

The IP shows no active service exposure, likely configured as a backend or firewalled resource.

---

## Recommended Actions

Detection Rules:

• Monitor for outbound connections from this IP range
• Alert on DNS queries to ahrefs.net from unexpected sources
• Track subnet-level abuse patterns in 142.44.233.0/24

Blocking Considerations:

• Risk score (40) does not warrant immediate blocking
• Consider geographic blocking if legitimate traffic not expected from region
• Monitor for changes in service exposure

Investigation Priorities:

1. Verify legitimate use case for ahrefs.net infrastructure

2. Assess correlation with other 142.44.233.0/24 IPs

3. Review DNSBL listing reason for single blacklist entry

---

Intelligence Quality: Moderate

Data Confidence: Variable (0.24–0.75)

Last Updated: 2026-06-17 12:02:13 UTC

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.