198.244.168.105📋 Copy

INTELLIGENCE BRIEFING: 198.244.168.105/32

ASSIGNED RISK RATING: MODERATE (40/100)

---

EXECUTIVE SUMMARY

IP 198.244.168.105 is a cloud hosting infrastructure address owned by Ahrefs Pte Ltd Dmytro (ASN 16276), located in London, England. While the IP shows no active threat indicators, the associated /24 subnet demonstrates high-abuse characteristics with 216 of 256 sibling IPs flagged as threats. Current observation shows firewalled status with no open services.

---

OWNERSHIP & INFRASTRUCTURE

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276
• Geolocation: London, England, GB (750km accuracy radius)
• Infrastructure Type: CloudCompute, Hosting
• Provider: OVH (origin ASN 16276, BGP prefix 198.244.128.0/17)
• DNS Records: proxy-uk001-san105.ahrefs.net (ahrefs.net)
• Status: No open ports detected; HTTP services inactive

---

THREAT INDICATORS

• Risk Score: 40 (Moderate)
• DNSBL Listings: 1 of 8 total blacklists
• Known Campaigns: None identified
• Tor Exit/Attacker/Spam Source: Negative
• Abuse Confidence: Not elevated

---

SUBNET ENVIRONMENT ANALYSIS

• Subnet: 198.244.168.0/24
• Abuse Density: 0.8438 (high_abuse classification)
• Total Siblings: 256
• Threat Siblings: 216 (84% threat ratio)
• Active Siblings: 208
• Risk Distribution: 45 medium-risk, 55 low-risk neighbors

Context: This IP resides in a subnet with significant abuse concentration. The high sibling threat ratio suggests either compromised infrastructure or shared hosting with abused peers.

---

OBSERVATION HISTORY (30 signals)

• Most Recent: 2026-06-28 (confidence 0.30)
• Subnet Classification: Consistently flagged as high_abuse since 2026-06-20
• Geolocation Signals: Inference points to London, GB (confidence 0.28)
• Threat Persistence: No persistent malicious behavior detected
• Stability: Ownership changes: 0; Route changes (30d): 0

---

RELATIONSHIP GRAPH (46 relationships)

• Primary connections: Same network (OVH_282347337)
• No additional organizational or certificate relationships identified
• Network-level associations only

---

RECOMMENDED ACTIONS

Immediate Mitigation (Probabilistic - combine with other signals):

Strategic Considerations:

1. Subnet-level blocking may be warranted given 84% threat sibling ratio

2. Monitor for service activation on this IP

3. Cross-reference with organizational threat intelligence for Ahrefs-related campaigns

4. Consider implementing geolocation-based filtering (GB region) if abuse patterns correlate with this subnet

---

ASSESSMENT: This IP represents moderate risk primarily due to neighborhood contamination. Current state shows no active exploitation, but the subnet environment suggests defensive posture monitoring is appropriate. No immediate threat indicators detected for this specific address.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.