198.244.168.106📋 Copy

# IP INTELLIGENCE BRIEFING: 198.244.168.106/32

Classification: Moderate Risk | Date Generated: June 2026

---

## Executive Summary

IP address 198.244.168.106 presents a moderate risk profile (Risk Score: 40) and is hosted on OVH cloud infrastructure in London, United Kingdom (ASN: 16276). The IP resolves to hostname proxy-uk001-san106.ahrefs.net under the ahrefs.net domain, indicating association with Ahrefs Pte Ltd. No active threat indicators were detected in current profiling, though the subnet exhibits elevated abuse characteristics.

---

## Ownership and Infrastructure

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH)
• Infrastructure Type: CloudCompute
• Geolocation: London, England, GB
• Network Role: Firewalled / No Services (No open ports detected)
• Registration Authority: ARIN

---

## Threat Assessment

---

## Network Context

The IP resides within subnet 198.244.168.0/24, which demonstrates elevated abuse density (0.8125). Subnet analysis reveals:

• Total Siblings: 256
• Active Siblings: 202
• Threat Siblings: 208
• Abuse Classification: High Abuse

Inherited risk from subnet context: 32. Risk distribution in sampled neighbors indicates medium risk (58) and low risk (42) IPs, with no high-risk siblings sampled in the immediate neighborhood analysis.

---

## Historical Observations

22 signal observations tracked. Key historical signals indicate:

• Consistent cloud infrastructure classification (OVH)
• Stable geographic location (GB)
• No persistent malicious behavior detected
• Most recent observations from June 2026
• Operator score: 0.2174 (Minimal)

---

## Relationship Graph

46 relationships identified, primarily same-network associations with network identifier OVH_282347337. No certificate or hostname relationships beyond the ahrefs.net domain were observed.

---

## Recommended Actions

Based on the moderate risk profile and subnet abuse characteristics, the following defensive measures are recommended:

1. Monitor: Continue monitoring for unusual outbound patterns from this IP

2. Blocklist Consideration: Evaluate for addition to local blocklists due to high-abuse subnet context

3. DNSBL Monitoring: Track for changes in DNSBL listing status

4. Traffic Analysis: Scrutinize traffic patterns from this IP for anomalies given the firewalled/no-services profile

---

Analyst Notes: The IP demonstrates legitimate hosting characteristics with association to a known technology company (Ahrefs). However, the subnet-level abuse density warrants heightened monitoring. No immediate blocking is recommended absent specific threat correlation, but the IP should be added to watchlists for continued observation.

Data Sources: IPDebrief Intelligence Platform | Confidence Level: Standard

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.