198.244.240.45📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 198.244.240.45/32

Classification: Moderate Risk (Score: 40/100)

Date: Intelligence generated from full profile analysis

---

## EXECUTIVE SUMMARY

IP 198.244.240.45 operates as cloud-hosted infrastructure under OVH (ASN 16276) within the Ahrefs Pte Ltd ecosystem. While the IP resolves to legitimate Ahrefs domains (proxy-uk006-san45.ahrefs.net), it is situated in a high-abuse-density subnet (198.244.240.0/24) with 83% abuse density. The IP presents as firewalled with no active services but is listed on 8 DNSBLs with one high-severity listing.

---

## INFRASTRUCTURE PROFILE

---

## THREAT INDICATORS

• Blacklist Status: Listed on 8 DNSBLs (1 high-severity)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None identified
• Abuse Confidence: Moderate

---

## NEIGHBORHOOD ANALYSIS

Subnet: 198.244.240.0/24

• Abuse Density: 0.8359 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 199 (78% utilization)
• Threat Siblings: 214 (85% of active)
• Risk Distribution: 47 medium, 53 low, 0 high

The subnet exhibits concentrated abuse activity despite hosting Ahrefs infrastructure, suggesting potential infrastructure sharing or compromised co-located assets.

---

## OBSERVATION HISTORY

Total Observations: 19

• Recent Activity: June 20, 2026 (5 observations)
• DNSBL Listings: Confirmed 8 total lists with high-severity categorization
• Subnet Classification: Persistent high_abuse designation
• Provider Consistency: OVH (cloud hosting)
• Operator Score: 0.2174 (Minimal operator risk)

---

## CONTROL PLANE DATA

• BGP Prefix: 198.244.128.0/17
• Route Stability: False
• RPKI State: Null
• Route Changes (30d): 0
• DNSSEC: Valid
• CAA Records: Present

---

## RELATIONSHIP MAPPING

• Total Relationships: 37
• Primary Association: Same Network (OVH_282347342)
• Network-Level Links: 32+ redundant network associations
• No direct links to: Hostnames, organizations, or certificates outside network infrastructure

---

## RECOMMENDED ACTIONS

1. Monitor subnet abuse patterns – High abuse density (0.8359) warrants continued surveillance of 198.244.240.0/24 range

2. Verify Ahrefs association – Confirm legitimate business use despite infrastructure sharing with high-risk peers

3. DNSBL monitoring – Track changes in blacklist status across all 8 listed feeds

4. Geolocation validation – London location aligns with expected Ahrefs operations but monitor for anomalies

5. No immediate blocking required – Moderate risk score with no active threat indicators; observe rather than block

---

Analyst Notes: The IP presents a legitimate business entity (Ahrefs) operating within a high-risk hosting environment. Recommend maintaining monitoring stance rather than defensive blocking, but treat inbound connections from this subnet with elevated scrutiny.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.