198.244.168.128📋 Copy

# IP Intelligence Briefing: 198.244.168.128

## Executive Summary

IP address 198.244.168.128 was classified as Moderate Risk (Risk Score: 40) with ownership attributed to Ahrefs Pte Ltd Dmytro under ASN 16276 (OVH). The IP operates within an OVH cloud infrastructure environment in London, England, resolving to a proxy hostname for the ahrefs.net domain. While the IP itself showed no open services, the associated /24 subnet exhibited high abuse density, warranting network-level defensive measures.

## Technical Profile

Ownership & Infrastructure:

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• RIR: ARIN
• Network Role: CloudCompute (OVH), Hosting infrastructure
• Geolocation: London, England, GB (GeoPlausible: true)
• BGP Prefix: 198.244.128.0/17

DNS & Resolution:

• PTR Hostname: proxy-uk001-san128.ahrefs.net
• Forward Resolution: proxy-uk001-san128.ahrefs.net
• Domain: ahrefs.net
• Forward Confirmed: No

Security Posture:

• DNSBL Listed: 1 of 8 total lists
• Open Ports: None detected
• TLS Certificate: None
• HTTP Services: None active

## Neighborhood Intelligence

The IP resides within subnet 198.244.168.128/24, which demonstrated elevated threat characteristics:

• Subnet Classification: High Abuse
• Abuse Density: 0.8047
• Total Siblings: 256 IPs
• Active Siblings: 191
• Threat Siblings: 206
• Inherited Risk Score: 32

Risk distribution across the /24 showed 100 medium-risk IPs, 0 high-risk, and 0 low-risk. This indicates systemic risk within the broader subnet allocation.

## Historical Observations

Signal history recorded 23 observations over the monitoring period. Key signals included:

• Consistent DNS resolution to ahrefs.net with CAA records present
• Neighborhood abuse classification signals showing persistent high-abuse categorization
• ASN-level reputation data from AlienVault OTX showing France-based attribution for AS16276
• Operator score of 0.2174 with "Minimal" classification

Route stability assessment indicated the BGP prefix was not stable. No persistent malicious activity was observed over time.

## Relationship Graph

The IP maintained 38 relationships, predominantly classified as Same Network relationships to OVH_282347337. No external entity relationships (hostnames, organizations, certificates) were identified beyond the network-level associations.

## Recommended Actions

Based on the risk profile, the following firewall rules were generated:

iptables:

```

iptables -A INPUT -s 198.244.168.128 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 198.244.168.128 drop

```

nginx:

```

deny 198.244.168.128;

```

pfSense:

```

198.244.168.128/32

```

Cloudflare WAF:

```json

{"description":"Block 198.244.168.128 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 198.244.168.128"}}

```

AWS WAF:

```json

{"Addresses":["198.244.168.128/32"],"Description":"IPDebrief risk 40"}

```

## Assessment

IP 198.244.168.128 presented moderate risk with no active services and no threat indicators. The primary concern stemmed from the high-abuse density of the parent /24 subnet. No evidence of active malicious campaigns, known attacker status, or spam source designation was found. The IP resolves to legitimate infrastructure (ahrefs.net proxy) but the neighborhood context suggests compromised or misconfigured peers within the same subnet.

Recommendation: Apply blocking rules at perimeter firewalls and WAF layers for the specific IP. Monitor subnet 198.244.168.0/24 for additional compromise indicators given the 80%+ abuse density.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.