198.244.168.143📋 Copy

## THREAT INTELLIGENCE BRIEFING

Target IP: 198.244.168.143/32

Date: 2026-06-20

Classification: Moderate Risk Cloud Infrastructure

---

EXECUTIVE SUMMARY

IP 198.244.168.143 is a cloud compute host associated with Ahrefs Pte Ltd Dmytro (AS16276, OVH provider) located in London, England. The IP presents a moderate risk profile (risk score: 40) with no active threat indicators. However, the IP resides within a subnet exhibiting high abuse density (81.64%), warranting contextual awareness despite the individual host showing no confirmed malicious activity.

---

INFRASTRUCTURE PROFILE

Network Classification:

• Provider: OVH (CloudCompute infrastructure)
• ASN: 16276
• RIR: ARIN
• Infrastructure Type: CloudHosting
• DNS PTR: proxy-uk001-san143.ahrefs.net
• Hosted Domain: ahrefs.net

Geolocation:

• Country: GB (United Kingdom)
• Region: England
• City: London
• Geo-Consensus: True
• Accuracy Radius: 750km

Network Services:

• Open Ports: None detected
• TLS Certificate: None
• HTTP Services: None
• Connection Status: Firewalling detected (no services accessible)

---

THREAT ASSESSMENT

Risk Score: 40/100 (Moderate Risk)

Abuse Confidence: Not explicitly calculated

Known Threat Indicators: None

Blacklist Status: 0 blacklists (1 DNSBL listing identified)

Threat Categories:

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Persistent Malicious: No

---

SUBNET CONTEXT ANALYSIS

Subnet: 198.244.168.0/24

Abuse Density: 0.8164 (High Abuse Classification)

Sibling Statistics:

• Total Siblings: 256
• Active Siblings: 191
• Threat Siblings: 209
• Inherited Risk Score: 32

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 22
• Low Risk: 78

Assessment: The subnet exhibits elevated abuse characteristics with 81.64% of active IPs flagged. This contextual factor elevates risk assessment despite the target IP showing no direct threat indicators.

---

OBSERVATION HISTORY

Total Observations: 22

Recent Activity:

• 2026-06-20: Operator score 0.2174 (Minimal classification)
• 2026-06-15: Subnet abuse density confirmed at 0.8164
• 2026-06-15: Provider confirmed as OVH

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 1

---

NETWORK RELATIONSHIPS

DNS Associations:

• Hostname: proxy-uk001-san143.ahrefs.net (16 DNS association records)
• Domain: ahrefs.net
• CAA Records: Present
• DNSSEC: Valid

Network Associations:

• Same Network: OVH_282347337 (12+ associations)

---

RECOMMENDED ACTIONS

Risk-Based Mitigation: Block recommended (risk score: 40)

Firewall Rules Generated:

• iptables: `iptables -A INPUT -s 198.244.168.143 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 198.244.168.143 drop`
• nginx: `deny 198.244.168.143;`
• pfSense: `198.244.168.143/32`
• Cloudflare WAF: Block with expression `ip.src eq 198.244.168.143`
• AWS WAF: Address `198.244.168.143/32`

---

INTELLIGENCE CONCLUSIONS

1. Primary Risk: Subnet-level abuse density (81.64%) creates elevated contextual risk

2. Individual Host Status: No direct threat indicators; firewalling detected

3. Infrastructure Type: Legitimate cloud hosting environment (OVH/Ahrefs)

4. Recommendation: Monitor traffic patterns; block at perimeter if required by organizational policy

Assessment Confidence: Moderate — subnet-level data supports risk determination despite lack of direct threat indicators on target host.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.