# 202.8.41.187 — IP Intelligence Summary

202.8.41.187 is an IPv4 address operated by Ahrefs Pte Ltd administrator (AS140577), geolocated to Ashburn, United States. Its reverse DNS name is sardine443.ahrefs.net. As of August 29, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/202.8.41.187
- Last updated: 2026-08-29

## Ownership

- Organization: Ahrefs Pte Ltd administrator
- Network name: AHREFS-CRAWLER-A-USA
- Allocated block: 202.8.40.0/23
- ASN: AS140577 (https://ipdebrief.com/asn/140577)
- Regional registry: APNIC

## Location

- City: Ashburn
- Region: Virginia
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- sardine443.ahrefs.net
- Forward-confirmed: yes

## Exposed services

- 22/tcp — ssh

## Analyst narrative

\## INTELLIGENCE BRIEFING: 202.8.41.187/32

**Classification:** LOW RISK – LEGITIMATE INFRASTRUCTURE

**Executive Summary:**

The IP address 202.8.41.187 is identified as Ahrefs crawler infrastructure with no active threat indicators. The IP maintains a risk score of 0 and shows no evidence of malicious activity. Recommended action: ALLOW with monitoring.

\---

\### Profile Summary

| Attribute | Value |

|-----------|-------|

| **Risk Score** | 0 (Low Risk) |

| **Organization** | Ahrefs Pte Ltd administrator |

| **ASN** | 140577 |

| **BGP Prefix** | 202.8.40.0/23 |

| **Geolocation** | US (Boston, MA consensus) |

| **DNS** | sardine443.ahrefs.net → ahrefs.net |

| **Services** | Firewalled / No Services |

| **Network Role** | Infrastructure |

\---

\### Threat Assessment

**Active Threat Indicators:** NONE

\- No blacklisting (8 DNSBL total references, 0 active listings)

\- Not classified as Tor exit, known attacker, or spam source

\- No associated threat campaigns or abuse indicators

\- Zero honeypot hits, enumeration strikes, or WAF violations

**Control Plane:**

\- Route stability: UNSTABLE

\- DNSSEC: Valid

\- RPKI/IRR: Not verified

\---

\### Observation History (17 signals)

Recent activity (2026-07-24) confirms:

\- RIR Registration: APNIC (Ahrefs Pte Ltd administrator)

\- Netname: AHREFS-CRAWLER-A-USA

\- Domain Association: ahrefs.net (CAA records present)

\- DNS Resolution: Confirmed forward resolution to ahrefs.net

No temporal degradation in reputation observed.

\---

\### Subnet Neighborhood (202.8.41.0/24)

| Metric | Value |

|--------|-------|

| **Total Siblings** | 100 |

| **Abuse Density** | 0% |

| **High Risk** | 0 |

| **Medium Risk** | 5 |

| **Low Risk** | 95 |

Notable neighbor: 202.8.41.9 (Risk Score: 50)

The subnet demonstrates minimal abuse presence, with 95% of neighbors classified as low risk.

\---

\### Relationship Graph

| Type | Target |

|------|--------|

| DNS Association | sardine443.ahrefs.net |

\---

\### Recommended Actions

**Firewall/Security Policy:**

\- **ALLOW** inbound/outbound traffic (no blocking required)

\- No firewall rules generated (risk score 0)

\- Continue standard logging and monitoring

**Monitoring Triggers:**

\- Alert if risk score increases above threshold

\- Monitor for new threat indicator additions

\- Track DNS resolution changes to non-ahrefs.net domains

\---

\### Analyst Notes

This IP belongs to Ahrefs' crawler infrastructure, which is a legitimate SEO analytics service. The IP is actively resolving to ahrefs.net with proper DNS configuration. The subnet shows minimal abuse density, supporting the conclusion of legitimate infrastructure operations. No immediate defensive action required, but maintain baseline monitoring for operational changes.

## Nearby addresses

- 202.8.41.0 (https://ipdebrief.com/202.8.41.0)
- 202.8.41.5 (https://ipdebrief.com/202.8.41.5)
- 202.8.41.7 (https://ipdebrief.com/202.8.41.7)
- 202.8.41.8 (https://ipdebrief.com/202.8.41.8)
- 202.8.41.9 (https://ipdebrief.com/202.8.41.9)
- 202.8.41.12 (https://ipdebrief.com/202.8.41.12)
- 202.8.41.13 (https://ipdebrief.com/202.8.41.13)
- 202.8.41.14 (https://ipdebrief.com/202.8.41.14)
- 202.8.41.15 (https://ipdebrief.com/202.8.41.15)
- 202.8.41.16 (https://ipdebrief.com/202.8.41.16)
- 202.8.41.17 (https://ipdebrief.com/202.8.41.17)
- 202.8.41.18 (https://ipdebrief.com/202.8.41.18)

---

Source: IPDebrief, "202.8.41.187 IP intelligence", https://ipdebrief.com/202.8.41.187, updated 2026-08-29. Assessments are probabilistic.