198.244.242.59📋 Copy

## IP Intelligence Briefing: 198.244.242.59/32

Classification: Moderate Risk (Score: 50)

Report Generated: Based on comprehensive IP intelligence data

Target: 198.244.242.59

Executive Summary

The target IP address 198.244.242.59 operates within OVH cloud infrastructure (ASN 16276) in London, England. The IP resolved to proxy-uk007-san59.ahrefs.net, indicating association with Ahrefs Pte Ltd Dmytro. Despite the legitimate domain association, the IP exhibits elevated risk characteristics including high-abuse subnet classification, multiple blacklistings, and control plane inconsistencies.

Network Infrastructure

• Provider: OVH Cloud
• ASN: 16276
• Geolocation: London, England, GB (accuracy radius: 750km)
• Infrastructure Type: CloudCompute
• Network Role: Hosting provider with firewalled/no services status
• BGP Prefix: 198.244.128.0/17

Threat Indicators

Risk Profile:

• Overall Risk Score: 50 (Moderate Risk)
• Abuse Confidence Score: Not determined
• Blacklist Count: 2 active listings out of 8 total
• DNSBL Listed: Yes (2/8 lists)

Threat Feed Analysis:

• No known campaigns correlated
• No threat indicators in feeds
• Not identified as Tor exit node or known attacker
• Reputation sources: Multiple sources indicate moderate risk

Control Plane:

• Route stability: Inconsistent (isRouteStable: false)
• RPKI State: Not evaluated
• IRR Consistency: Not evaluated
• Route changes in 30 days: 0

Subnet Analysis (198.244.242.0/24)

• Abuse Density: 0.6758 (High abuse classification)
• Total Siblings: 256
• Active Siblings: 206
• Threat Siblings: 173 (67.6% threat ratio)
• Inherited Risk Score: 27
• Subnet Classification: High abuse

Historical Observations

Signal observation history indicates 19 total observations with the following timeline:

• 2026-06-17 00:42: Multiple blacklistings detected (8 total lists, 2 active with high severity)
• 2026-06-15 16:41: High abuse subnet classification confirmed
• 2026-06-15 16:34-16:32: Geolocation inference and operator scoring conducted

Recent observations show persistent blacklist presence with high-severity classifications.

DNS Analysis

• PTR Hostnames: proxy-uk007-san59.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed
• Email Authentication: No SPF or DMARC records detected
• TXT Records: 0
• Forward Hostnames: proxy-uk007-san59.ahrefs.net

Network Relationships

The IP maintains relationships with:

• Network: OVH_282347343 (multiple associations)
• Hostnames: proxy-uk007-san59.ahrefs.net (16+ DNS associations)

Recommended Security Actions

Based on the IP's risk profile, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 198.244.242.59 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 198.244.242.59 drop

```

nginx:

```

deny 198.244.242.59;

```

pfSense:

```

198.244.242.59/32

```

Cloudflare WAF:

```

Block 198.244.242.59 — IPDebrief risk score 50

```

AWS WAF:

```

Addresses: ["198.244.242.59/32"]

Description: IPDebrief risk 50

```

Analysis Notes

The IP address presents moderate risk primarily due to subnet-level abuse characteristics. While the DNS resolves to a legitimate ahrefs.net hostname, the high-abuse subnet classification (0.6758 density) and 173 threat siblings suggest the IP may be misused within the hosting environment. The route stability issues and DNSBL listings indicate ongoing reputation concerns.

Recommendation: Implement blocking rules while monitoring for legitimate traffic patterns. Consider geolocation-based filtering if legitimate operations require access from this subnet.

---

*This intelligence briefing is based on IPDebrief analysis. All data presented is derived from observed network signals and threat intelligence sources.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.