198.244.240.220📋 Copy

# IP Intelligence Briefing: 198.244.240.220/32

## Executive Summary

IP 198.244.240.220 presents a moderate risk profile with a risk score of 40. The address belongs to OVH's cloud infrastructure in London, England, and is associated with Ahrefs Pte Ltd Dmytro. While the IP itself shows no active threat indicators, the /24 subnet exhibits high abuse density (83.6%), warranting defensive measures.

## Ownership and Geolocation

• ASN: 16276
• Organization: Ahrefs Pte Ltd Dmytro
• Network: OVH cloud compute infrastructure
• Location: London, England, GB
• Registration: ARIN RIR

## Network Classification

• Infrastructure Type: Cloud compute (OVH)
• Hosting: Yes
• CDN/VPN/Proxy: No
• Tor Exit: No
• Mobile/Residential: No
• Bogon: No
• Anycast: No

## DNS Analysis

• PTR Hostname: proxy-uk006-san220.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: 1 hostname confirmed
• Email Authentication: No SPF, DMARC, or TXT records configured

## Security Posture

• Open Ports: None detected
• HTTP Services: None detected
• TLS Certificate: None
• DNSBL Status: Listed on 1 of 8 threat feeds
• Reputation: Moderate risk (score 40/100)

## Neighborhood Assessment

The /24 subnet 198.244.240.220/24 demonstrates significant abuse activity:

• Abuse Density: 0.8359 (high abuse)
• Total Siblings: 256
• Active Siblings: 199
• Threat Siblings: 214 (83.6%)
• Risk Distribution: 47 medium-risk, 53 low-risk IPs in subnet

## Historical Signals

22 observations recorded with consistent cloud infrastructure classification. Abuse density signals observed across multiple observation windows, indicating persistent subnet-level activity patterns.

## Related Entities

37 relationships identified, primarily network-level associations with OVH_282347342.

## Recommended Actions

Based on the IP's risk profile and subnet context, the following defensive measures are recommended:

Firewall Rules:

• iptables: `iptables -A INPUT -s 198.244.240.220 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 198.244.240.220 drop`
• nginx: `deny 198.244.240.220;`
• pfSense: `198.244.240.220/32`

WAF Configuration:

• Cloudflare WAF: Block with expression `ip.src eq 198.244.240.220`
• AWS WAF: Add `198.244.240.220/32` to allow list or block rule

## Intelligence Assessment

The IP should be treated as a defensive priority due to subnet-level abuse activity, despite the individual address showing no active malicious indicators. The high concentration of threat-sibling IPs within the /24 suggests coordinated abuse infrastructure. Consider blocking the entire /24 subnet or implementing rate limiting if business requirements permit legitimate traffic from this range.

---

*Analysis generated from IPDebrief intelligence platform data.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.