198.244.240.128📋 Copy

# IP Intelligence Briefing: 198.244.240.128

## Executive Summary

IP 198.244.240.128 is a cloud-hosted proxy server associated with ahrefs.net infrastructure, located in London, England. The IP carries a moderate risk score of 40 and operates within a high-abuse density subnet. While the IP itself shows no active threat indicators, its network environment warrants defensive monitoring.

## Ownership and Infrastructure

• Provider: OVH (ASN 16276)
• Organization: Ahrefs Pte Ltd Dmytro
• Infrastructure Type: Cloud Compute / Hosting
• Geolocation: London, England, GB
• DNS Resolution: proxy-uk006-san128.ahrefs.net
• Service Status: Firewalled / No Services Detected

## Risk Assessment

• Overall Risk Score: 40 (Moderate Risk)
• Abuse Confidence: DNSBL listed on 1 of 8 total lists
• Threat Classifications: Not Tor, not known attacker, not spam source
• Campaign Affiliation: None detected

## Network Context

The IP resides within subnet 198.244.240.0/24, which exhibits elevated abuse characteristics:

• Abuse Density: 0.7695 (High Abuse Classification)
• Total Subnet IPs: 256
• Active Siblings: 163
• Threat Siblings: 197

This elevated neighborhood risk suggests the subnet may host multiple services, with the target IP potentially serving as a legitimate proxy endpoint within a broader infrastructure.

## Observation History

Analysis of 21 historical observations from June 15-20, 2026 indicates:

• Operator Score: Consistent 0.2174 (Minimal)
• Threat Persistence: None observed
• Ownership Changes: 0 recorded
• Signal Stability: High consistency across observation periods

## Relationship Mapping

• Network Association: OVH_282347342 (multiple network-level connections)
• DNS Associations: proxy-uk006-san128.ahrefs.net (15 DNS relationship records)

## Defensive Recommendations

Based on the risk profile, the following actions are recommended:

Firewall Rules

• iptables: `iptables -A INPUT -s 198.244.240.128 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 198.244.240.128 drop`
• nginx: `deny 198.244.240.128;`

WAF Integration

• Cloudflare WAF: Block with expression `ip.src eq 198.244.240.128`
• AWS WAF: Configure with address `198.244.240.128/32`

## Intelligence Narrative

The target IP functions as a proxy endpoint within ahrefs.net's UK infrastructure, likely serving legitimate SEO analytics traffic. While the IP shows no direct threat indicators, its placement within a high-abuse subnet (198.244.240.0/24) with nearly 80% abuse density warrants caution. The 197 threat siblings in the subnet indicate significant malicious activity from related addresses, though the target IP itself remains clean.

Recommendation: Implement blocking rules as a defensive measure against potential abuse originating from the subnet. Monitor for any service changes or risk score escalations in the neighborhood. Given the legitimate business association (ahrefs.net), consider whitelisting if the IP is confirmed for legitimate business operations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.