198.244.240.162📋 Copy

# INTELLIGENCE BRIEFING: 198.244.240.162

Classification: Moderate Risk | Report Date: 2026-06-23

## Executive Summary

IP 198.244.240.162 is a cloud-hosted infrastructure endpoint associated with Ahrefs Pte Ltd Dmytro, operating under OVH (ASN 16276). The IP resolves to proxy-uk006-san162.ahrefs.net and is geolocated to London, England. While the endpoint itself shows moderate risk (40), it resides in a subnet (198.244.240.0/24) with high abuse density (0.793) and 203 of 256 sibling IPs flagged as threats.

## Technical Profile

## Neighborhood Analysis

The /24 subnet (198.244.240.0/24) exhibits concerning characteristics:

• Abuse Density: 0.793 (high_abuse classification)
• Active Siblings: 165 of 256 addresses
• Threat Siblings: 203 IPs flagged
• Risk Distribution: 100 medium-risk neighbors, 0 high, 0 low

This indicates the subnet is heavily utilized for potentially malicious activity, though the specific IP maintains moderate risk.

## Threat Indicators

• Blacklist Status: 0 lists
• Tor Exit: False
• Known Attacker: False
• Spam Source: False
• Abuse Confidence: Low/None
• Campaign Likelihood: None
• Threat Persistence: 0 days (not persistently malicious)

## Observation History

• Total Observations: 26 signals
• Recent Activity: June 2026 (last observed 2026-06-23T04:16:35Z)
• Key Signals:

- DNS resolution to ahrefs.net domain (confidence: 0.80)

- Geolocation inference: GB (confidence: 0.28)

- Routing operator score: Minimal (0.087)

- RTT measurements: 94-101ms (geo-plausible)

## Network Relationships

• Network Associations: 54 relationships to OVH infrastructure (OVH_282347342)
• Control Plane: Route stability: false, RPKI: inconsistent
• DNSSEC: Valid

## Recommended Actions

For SOC Teams:

1. Monitor Closely: The subnet's high abuse density warrants enhanced monitoring even though this IP shows moderate risk.

2. Contextual Assessment: Correlate traffic patterns with known Ahrefs infrastructure baseline.

3. Geographic Validation: Verify traffic origin aligns with London, GB geolocation.

4. Service Verification: Confirm no unauthorized services are running (endpoint is currently firewalled).

5. Subnet Intelligence: Consider broader investigation of 198.244.240.0/24 due to 203 threat-sibling IPs.

Firewall Recommendations:

• No specific blocking rules recommended at this time
• Monitor for service discovery attempts
• Watch for behavioral anomalies given subnet abuse density

## Risk Assessment

This IP represents a cloud-hosted infrastructure endpoint with legitimate Ahrefs association but elevated contextual risk due to neighborhood abuse density. SOC teams should maintain awareness of the subnet's threat profile while treating this specific IP as moderate risk requiring normal monitoring protocols.

---

*Report generated from IPDebrief intelligence platform data. All data current as of 2026-06-23.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.