142.44.233.47📋 Copy

IP Intelligence Briefing: 142.44.233.47/32

Date: 2026-06-13

---

**1. Core Profile**

• Risk Score: 50 (Moderate Risk)
• Provider: OVH (ASN 16276)
• Ownership: Registered to *Dmytro, Ahrefs Pte Ltd* (OVH-CUST-281059682)
• Geolocation: Canada (QC, Montreal), but geo-plausibility is false (RTT anomaly detected).
• Network Role: CloudCompute instance (OVH Hosting).

---

**2. Threat & Security Indicators**

• Threat Activity: No direct indicators of malicious activity (no malware, spam, or known attacker associations).
• DNS: Resolves to `proxy-ca003-san47.ahrefs.net` (Ahrefs domain).
• Subnet Risk:

- /24 subnet (142.44.233.0/24) has 60.16% abuse density.

- 154 of 256 siblings are flagged as malicious.

- High-risk subnet classification suggests potential for lateral movement or compromised hosts.

---

**3. Historical Observations**

• 21 observations over 30 days:

- Consistent network role (CloudCompute) and DNS records.

- Geolocation anomalies (RTT discrepancy of 26ms vs. expected 112ms for 5,598km distance).

- No significant changes in risk scores or threat indicators.

---

**4. Relationships & Network Context**

• Linked Entities:

- Subnet: `142.44.233.0/24` (OVH customer network).

- Domain: `ahrefs.net` (linked via PTR record).

• Neighbor Analysis:

- 190 active IPs in subnet; 154 are malicious.

- Inherited risk: 24 (substantial exposure due to subnet abuse).

---

**5. Recommended Actions**

• Monitor Traffic: Given the subnet’s high abuse density, prioritize monitoring traffic from this IP.
• Block if Suspicious: Use the following firewall rules to block the IP:

```bash

iptables -A INPUT -s 142.44.233.47 -j DROP

nft add rule inet filter input ip saddr 142.44.233.47 drop

```

• Investigate Ahrefs Link: Verify security posture of `ahrefs.net` and its subdomains.
• Subnet-Level Mitigation: Consider isolating or segmenting the `142.44.233.0/24` subnet to limit lateral movement.

---

Conclusion:

The IP is part of a high-risk OVH subnet associated with Ahrefs. While the IP itself shows no direct malicious activity, the subnet’s abuse density and geo-plausibility issues warrant heightened scrutiny. SOC teams should monitor traffic and consider subnet-level mitigations to reduce exposure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.