198.244.240.103📋 Copy

IP INTELLIGENCE BRIEFING: 198.244.240.103/32

Classification: MODERATE RISK — HOSTING INFRASTRUCTURE WITH HIGH-ABUSE SUBNET CONTEXT

---

EXECUTIVE SUMMARY

IP 198.244.240.103 is a cloud-hosting address in the OVH network with a moderate risk score of 40. The IP resides within a /24 subnet classified as "high_abuse" (0.832 abuse density), containing 213 identified threat siblings out of 256 total. No direct malicious activity indicators were observed on this specific IP.

---

OWNERSHIP & INFRASTRUCTURE

• Organization: Ahrefs Pte Ltd Dmytro (ASN 16276)
• Provider: OVH Cloud (Infrastructure Type: CloudCompute)
• Location: London, England, GB
• DNS PTR: proxy-uk006-san103.ahrefs.net
• Network Role: Hosting/CloudCompute with firewall/no services detected

---

THREAT INDICATORS & OBSERVATIONS

• Risk Score: 40 (Moderate)
• Abuse Confidence: 0 (no active threat indicators)
• Blacklist Status: 1 DNSBL listing (of 8 total lists monitored)
• Known Campaigns: None
• Known Attacker/Spam Source/Tor Exit: False
• Service Status: Firewall/no services detected

---

NEIGHBORHOOD ANALYSIS

The /24 subnet (198.244.240.0/24) exhibits elevated abuse activity:

• Total Subnet IPs: 256
• Active Siblings: 199
• Threat Siblings: 213
• Risk Distribution: 50 medium, 50 low risk (neighborhood lookup)
• Inherited Risk: 33

---

HISTORICAL SIGNALS

25 observations tracked. Most recent activity recorded 2026-06-28. Historical data shows consistent classification as cloud hosting infrastructure (OVH) with minimal changes in ownership or threat persistence. No escalation patterns observed.

---

RELATED ENTITIES

36 relationships identified, primarily same-network associations (OVH_282347342). No certificate matches or correlated IPs beyond network-level relationships.

---

RECOMMENDED ACTIONS

Based on moderate risk score and high-abuse subnet context:

Firewall Rules:

• `iptables -A INPUT -s 198.244.240.103 -j DROP`
• `nft add rule inet filter input ip saddr 198.244.240.103 drop`
• `nginx deny 198.244.240.103;`

WAF Integration:

• Cloudflare WAF: Block IP
• AWS WAF: Add 198.244.240.103/32 to deny list

---

ASSESSMENT

This IP is associated with Ahrefs hosting infrastructure on OVH cloud. While no direct threat indicators are present, the subnet context (0.832 abuse density, 213 threat siblings) warrants monitoring. Recommend blocking at edge firewall due to neighborhood risk profile. No immediate evidence of malicious activity originating from this specific IP.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.