198.244.240.203📋 Copy

IP Intelligence Briefing: 198.244.240.203

Date: 2026-06-14

---

**1. Core Profile**

• Risk Score: 50 (Moderate Risk)
• Ownership:

- Organization: Ahrefs Pte Ltd (Singapore)

- ASN: 16276 (OVH)

- Geolocation: London, England, UK (GeoPlausible: Yes)

• Network Role:

- Provider: OVH (CloudCompute Hosting)

- Subnet: 198.244.240.0/24

- Classification: High Abuse Subnet (abuse density: 54.69%)

---

**2. Threat Indicators**

• No malicious activity detected:

- No indicators of spam, attacker, or Tor exit nodes.

- Zero DNSBL listings and no known campaigns.

• DNS Associations:

- Linked to `proxy-uk006-san203.ahrefs.net` (Ahrefs’ proxy hostname).

- No email authentication records (SPF/DKIM/DMA).

---

**3. Observation History**

• Stability:

- BGP route stability: Unstable (route changes detected).

- No persistent malicious behavior (threat persistence: 0 days).

• Signal Trends:

- Minimal risk signals over time (confidence: 0.23–0.85).

- No spikes in threat or abuse activity.

---

**4. Network Relationships**

• Subnet Context:

- Part of 198.244.240.0/24, a high-abuse subnet with 256 IPs.

- 140 of 256 siblings flagged as threats (abuse density: 54.69%).

• Connected Entities:

- OVH Network: Same ASN (16276) as 282347342.

- Ahrefs DNS: Direct association with `proxy-uk006-san203.ahrefs.net`.

---

**5. Neighborhood Analysis**

• Subnet Risk Distribution:

- High Risk: 0 IPs

- Medium Risk: 88 IPs

- Low Risk: 12 IPs

• Notable Neighbors:

- IPs like `198.244.240.0` and `198.244.240.1` show moderate risk (score: 40–50).

- Subnet abuse density: 54.69% (high risk).

---

**6. Recommendations**

• Monitor:

- Track DNS and network behavior for anomalies, given the high-abuse subnet context.

- Validate Ahrefs’ proxy hostname (`proxy-uk006-san203.ahrefs.net`) for legitimate traffic.

• Firewall Rules:

- Allow traffic from OVH ASN (16276) but restrict unassociated IPs in the 198.244.240.0/24 subnet.

- Use IPDebrief’s [actions tool](#) for specific rule templates (e.g., iptables, Cloudflare WAF).

---

Conclusion:

This IP is a legitimate cloud-hosted proxy server operated by Ahrefs, part of a high-abuse subnet. While no direct threats are detected, the subnet’s elevated risk suggests closer monitoring. SOC teams should focus on validating DNS associations and isolating suspicious subnets.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.