142.44.233.35📋 Copy

# IP Intelligence Briefing: 142.44.233.35/32

## Executive Summary

Target IP 142.44.233.35 presents a moderate risk profile (risk score: 40) with significant contextual threat indicators. The IP resolves to a proxy hostname within the Ahrefs network (proxy-ca003-san35.ahrefs.net) but is hosted on OVH cloud infrastructure. The associated /24 subnet demonstrates high abuse density (69.14%), with 177 of 256 total sibling IPs flagged as threats. No active threat indicators were identified in real-time threat feeds.

## Network Intelligence

• IP Address: 142.44.233.35/32
• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 142.44.233.0/24 (OVH-CUST-281059682)
• Infrastructure Type: CloudCompute/Hosting
• Reverse DNS: proxy-ca003-san35.ahrefs.net (ahrefs.net)

## Geolocation Analysis

• Reported Country: CA (Canada)
• Reported City: Singapore
• Coordinates: 56.13°N, -106.35°W
• Geolocation Confidence: Low (plausibility: false)
• Validation Issue: RTT measurement (26ms) inconsistent with reported distance (5,598km minimum possible RTT: 112ms)
• Note: Significant geolocation discrepancy indicates potential data quality issues or misconfigured infrastructure

## Threat Assessment

• Overall Risk Score: 40 (Moderate)
• Threat Indicators: None detected
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Blacklist Count: 0
• DNSBL Status: Listed on 1 of 8 DNSBL lists
• Known Campaigns: None identified

## Subnet Neighborhood Analysis

The parent subnet (142.44.233.0/24) exhibits concerning abuse characteristics:

• Abuse Density: 69.14% (HIGH ABUSE classification)
• Total Sibling IPs: 256
• Active Sibling IPs: 198
• Threat Sibling IPs: 177
• Risk Distribution: 94 medium-risk, 6 low-risk, 0 high-risk neighbors

This high-density abuse environment suggests shared hosting infrastructure with multiple potential abuse vectors, requiring contextual risk assessment.

## Observed Behavior

• Network Role: Firewalled / No services open
• Open Ports: None detected
• HTTP/TLS Services: None active
• DNSSEC: Valid
• CAA Records: Present
• Ownership Stability: No ownership changes observed
• Threat Persistence: Not persistently malicious

## Historical Observation Summary

Analysis of 22 historical observations indicates:

• Recent subnet classification maintained as "high_abuse" (abuse density: 0.7578)
• No persistent malicious behavior detected
• Threat observation count: 1
• Average ownership days: Not established

## Recommended Actions

Firewall/Blocking Recommendations

Based on the moderate risk score and high-abuse neighborhood context, the following rules are recommended:

iptables:

```

iptables -A INPUT -s 142.44.233.35 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 142.44.233.35 drop

```

nginx:

```

deny 142.44.233.35;

```

pfSense:

```

142.44.233.35/32

```

Cloudflare WAF:

```json

{

"description": "Block 142.44.233.35 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 142.44.233.35"

}

}

```

AWS WAF:

```json

{

"Addresses": ["142.44.233.35/32"],

"Description": "IPDebrief risk 40"

}

```

## Intelligence Assessment

The target IP is associated with Ahrefs, a legitimate SEO analytics company, but operates within a high-abuse OVH hosting environment. While no active threat indicators were detected, the subnet's abuse density (69.14%) and the presence of 177 threat-sibling IPs warrant caution. The IP resolves to a proxy hostname (proxy-ca003-san35.ahrefs.net), suggesting potential use in web crawling or SEO operations.

Risk Determination: Moderate - Block recommended due to high-abuse neighborhood context.

Additional Context: The significant geolocation discrepancy (Canada vs. Singapore) and RTT validation failure suggest either infrastructure misconfiguration or potential spoofing. Correlation with other signals is advised before implementing permanent blocking measures.

---

*Intelligence generated from IPDebrief platform data. Recommendations should be validated with additional threat intelligence sources before production deployment.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.