198.244.240.146📋 Copy

# IP INTELLIGENCE BRIEFING: 198.244.240.146/32

## EXECUTIVE SUMMARY

IP address 198.244.240.146 presents a moderate risk profile (risk score: 40) associated with OVH cloud hosting infrastructure in London, GB. The IP is classified within a high-abuse subnet environment with significant neighborhood threat density. No active threat indicators or known attack campaigns were identified.

## OWNERSHIP AND INFRASTRUCTURE

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH)
• Geolocation: London, England, GB (750km accuracy radius)
• Infrastructure Type: Cloud Computing / Hosting
• Provider: OVH (firewalled/no services detected)
• DNS Resolution: proxy-uk006-san146.ahrefs.net
• Registration: ARIN registry

## THREAT ASSESSMENT

Current Risk Level: Moderate (40/100)

Threat Indicators:

• Blacklist Status: Not listed (0 blacklist hits)
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Campaign Affiliation: None detected

Control Plane Data:

• BGP Prefix: 198.244.128.0/17
• Route Stability: Unstable
• DNSSEC Valid: True
• Operator Score: 0.2174 (Minimal)

## NEIGHBORHOOD ANALYSIS

Subnet: 198.244.240.0/24

Risk Distribution in /24:

• High Risk: 0
• Medium Risk: 68
• Low Risk: 32

The subnet exhibits elevated abuse density with 207 threat-sibling IPs detected within the same /24 block.

## OBSERVATION HISTORY

Total Observations: 22

Recent Timeline:

• 2026-06-28T06:16:27 — Cloud infrastructure (OVH), hosting detected, confidence 0.90
• 2026-06-20T04:11:55 — Subnet classified as "high_abuse" with abuse density 0.8086, confidence 0.75
• 2026-06-20T04:10:55 — Operator score: Minimal (0.2174)

The IP has maintained consistent cloud hosting association with OVH infrastructure over the observation period. No significant threat profile changes detected.

## RELATIONSHIP MAPPING

Total Relationships: 45

• Primary Association: Same Network (OVH_282347342)
• Network Classification: Data center/hosting network
• Cross-References: 40+ additional same-network relationships

## SECURITY RECOMMENDATIONS

Immediate Actions:

Block — Recommended firewall rule implementation:

• iptables: `iptables -A INPUT -s 198.244.240.146 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 198.244.240.146 drop`
• nginx: `deny 198.244.240.146;`
• pfSense: `198.244.240.146/32`
• Cloudflare WAF: Block via expression `ip.src eq 198.244.240.146`
• AWS WAF: Add `198.244.240.146/32` to IP set

Risk Mitigation Notes:

While the IP shows moderate risk (40) with no active threat indicators, the high-abuse neighborhood context warrants consideration. The subnet's elevated abuse density (0.8086) and 207 threat-sibling IPs suggest broader network-level risk factors beyond this specific IP.

---

Analyst Notes: This IP is associated with a known security research organization (Ahrefs) operating through OVH cloud infrastructure. The moderate risk score reflects the high-abuse neighborhood rather than direct malicious activity. Consider implementing subnet-level monitoring for 198.244.240.0/24 given the elevated threat density.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.