198.244.240.195📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 198.244.240.195/32

Classification: Moderate Risk / Legitimate Infrastructure with High-Abuse Subnet Context

Date: Current Analysis Period

---

## EXECUTIVE SUMMARY

IP 198.244.240.195 is part of Ahrefs Pte Ltd infrastructure, hosted on OVH cloud compute services in London. The IP exhibits a moderate risk score of 40 with no active threat indicators. However, the /24 subnet demonstrates elevated abuse density (0.7695) with 197 of 256 siblings classified as threats. This represents legitimate SaaS infrastructure operating in a high-abuse neighborhood.

---

## OWNERSHIP & INFRASTRUCTURE

Key Finding: IP resolves to Ahrefs proxy infrastructure. No open ports or active services detected; classification indicates "Firewalled / No Services."

---

## THREAT ASSESSMENT

Threat Indicators: None detected. The IP is not flagged as a known attacker, spam source, or Tor exit node.

---

## SUBNET CONTEXT (198.244.240.0/24)

Assessment: The /24 subnet shows elevated abuse activity. However, the target IP (198.244.240.195) itself shows no malicious indicators, suggesting it is legitimate infrastructure within a high-density hosting environment.

---

## ROUTING & NETWORK STABILITY

• BGP Origin ASN: 16276
• AS Path: 57866 → 16276
• Route Stability: Stable (0 changes in 30 days)
• MoAS Status: Not MoAS
• RPKI State: Validated
• Delegation Age: 9,251 days

---

## OBSERVATION HISTORY

• Total Observations: 25
• Recent Activity: Observed 2026-06-15 and 2026-06-20
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0

The IP has remained consistently associated with Ahrefs infrastructure with no significant behavioral changes over the observation period.

---

## RECOMMENDED ACTIONS

Based on the moderate risk profile and lack of active threat indicators:

Recommended Approach: MONITOR

• The IP is legitimate Ahrefs infrastructure
• No specific threat indicators present
• Block only if organizational policy requires subnet-level protection

Firewall Rules (if blocking required)

```bash

# iptables

iptables -A INPUT -s 198.244.240.195 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.240.195 drop

# nginx

deny 198.244.240.195;

# Cloudflare WAF

Expression: ip.src eq 198.244.240.195

Action: block

```

---

## SOC ANALYST NOTES

1. Legitimate Infrastructure: This is Ahrefs proxy infrastructure. Traffic should not be blocked absent other indicators of compromise.

2. Subnet Risk: The /24 subnet has high abuse density. Monitor for patterns of abuse originating from this subnet that may affect reputation.

3. No Active Threats: No threat indicators, blacklists, or malicious campaigns associated with this specific IP.

4. Geolocation Discrepancy: ASN shows FR registration but geolocation indicates GB. This is consistent with OVH's multi-region hosting.

5. Classification: CloudCompute + Hosting suggests legitimate SaaS infrastructure, not residential or mobile.

Final Recommendation: Monitor but do not block. The IP represents legitimate cybersecurity infrastructure (Ahrefs) operating in a high-activity subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.