198.244.242.209📋 Copy

# Intelligence Briefing: IP 198.244.242.209

## Executive Summary

The IP address 198.244.242.209 was classified as Moderate Risk (Risk Score: 40) with ownership attributed to OVH infrastructure (ASN 16276). The address resolved to ahostname proxy-uk007-san209.ahrefs.net under the ahrefs.net domain, with geolocation data indicating London, England. No active services were detected on the host, with the network role classified as CloudCompute/Hosting infrastructure.

## Profile Analysis

Ownership & Infrastructure:

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Network Role: CloudCompute, Hosting, Firewall
• Geolocation: London, England, GB (Europe/London timezone)
• PTR Record: proxy-uk007-san209.ahrefs.net
• DNS: Single forward resolution confirmed

Threat Indicators:

• Blacklist Count: 1 DNSBL listing detected
• DNSBL Total Lists: 8
• Abuse Confidence Score: Not applicable
• Known Campaigns: None
• IsTorExit: False
• IsKnownAttacker: False
• IsSpamSource: False

Network Classification:

• Cloud: True
• CDN: False
• VPN: False
• Proxy: False
• Hosting: True
• Mobile: False
• Residential: False
• Bogon: False

## Neighborhood Assessment

The /24 subnet (198.244.242.0/24) exhibited high abuse density with an abuse density score of 0.6367. Analysis identified 256 total sibling IPs with 207 active siblings and 163 threat siblings. Risk distribution across the subnet showed 100 medium-risk IPs with zero high-risk classifications. The inherited risk score for this address was 25.

## Historical Observations

Twenty-seven signal observations were recorded. Key historical signals included:

• Operator classification: Minimal (0.1 raw score)
• Geolocation validation: Passed (geoPlausible: true, distance: 473.7 km, average RTT: 94ms)
• Subnet classification: High abuse density (0.6367)
• Threat observation count: 1
• No persistent malicious behavior detected

## Related Entities

Sixty-one relationships were identified, with multiple entries classified as Same Network relationships to OVH_282347343. The BGP origin ASN was 16276 with bgpPrefix 198.244.128.0/17.

## Recommended Actions

Based on the risk profile, the following firewall rules were generated:

• iptables: DROP traffic from 198.244.242.209
• nftables: DROP rule for source address 198.244.242.209
• nginx: Deny directive for the IP address
• pfSense: Block rule for 198.244.242.209/32
• Cloudflare WAF: Block with expression ip.src eq 198.244.242.209
• AWS WAF: Block rule for 198.244.242.209/32

No specific security action recommendations were generated beyond the default block rule.

## Assessment Notes

The address demonstrates characteristics of a hosted proxy/infrastructure endpoint associated with ahrefs.net. While the individual risk score was moderate (40), the subnet context indicates elevated abuse density. No evidence of active malicious campaigns or persistent threat behavior was observed. The absence of open ports and services suggests the address may be reserved or actively managed with restrictive firewall rules.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.