198.244.168.147📋 Copy

IP Intelligence Briefing: 198.244.168.147

Date: 2026-06-15

---

**1. Risk Profile**

• Risk Score: 40 (Moderate Risk)
• Provider: OVH (Cloud infrastructure)
• Ownership: Ahrefs Pte Ltd (legitimate entity, no abuse reports).
• Geolocation: London, England (plausible, no geo anomalies).
• Network Classification: High abuse subnet (198.244.168.0/24), with 55% abuse density.

---

**2. Threat Indicators**

• No direct malicious activity: No indicators of spam, attacks, or blacklists.
• Subnet Risk: 81/100 neighboring IPs in the subnet are medium/high risk, suggesting potential coordinated activity or compromised hosts.
• DNS Associations: Linked to `proxy-uk001-san147.ahrefs.net` (Ahrefs’ legitimate infrastructure).

---

**3. Network Behavior**

• Services: No open ports or TLS certificates detected.
• Routing: BGP prefix `198.244.128.0/17` (OVH-managed, stable).
• Subnet Activity: 141 active IPs in the /24 subnet, with 141 flagged as threats.

---

**4. Recommended Actions**

• Block the IP: Implement firewall rules to restrict traffic from 198.244.168.147.

- Example: `iptables -A INPUT -s 198.244.168.147 -j DROP`

• Monitor Subnet: Investigate high-risk neighbors in the 198.244.168.0/24 range.
• Verify Ahrefs Context: Confirm if the IP is part of a legitimate cloud setup or compromised infrastructure.

---

**5. Summary**

The IP is associated with Ahrefs but resides in a high-abuse subnet. While the IP itself shows no direct malicious activity, the surrounding network’s risk profile warrants closer scrutiny. SOC teams should monitor traffic patterns and validate the legitimacy of the subnet’s usage.

Next Steps: Correlate with internal logs, check for anomalous behavior in the subnet, and validate Ahrefs’ network security posture.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.