198.244.168.150📋 Copy

# IP Intelligence Briefing: 198.244.168.150/32

## Executive Summary

IP address 198.244.168.150 is assigned to OVH cloud infrastructure (ASN 16276) and resolves to Ahrefs Pte Ltd Dmytro organization. The IP presents a Moderate Risk profile (risk score: 40) with cloud hosting characteristics and no active open ports detected. While the IP itself shows minimal direct threat indicators, the associated /24 subnet exhibits high abuse density (0.8164) with 209 threat siblings out of 256 total IPs.

## Technical Profile

Ownership and Infrastructure

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH)
• Country: GB (London, England)
• Infrastructure Type: CloudCompute (OVH hosting)
• BGP Prefix: 198.244.128.0/17
• Registration: ARIN RIR

DNS Resolution

• PTR Hostname: proxy-uk001-san150.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: 1 hostname resolved
• Email Authentication: SPF, DMARC records absent

Network Services

• Open Ports: None detected
• HTTP/TLS Services: No active web services
• Infrastructure Status: Firewalled/No Services

## Threat Indicators

Direct Threat Assessment

• Abuse Confidence Score: Not explicitly scored
• DNSBL Listings: 1 of 8 lists (dnsblListedCount)
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Campaign Association: None identified

Control Plane Anomalies

• Route Stability: Not stable (isRouteStable: false)
• MOAS Classification: Not classified as MOAS
• RPKI State: Not reported

## Neighborhood Analysis

The /24 subnet (198.244.168.0/24) shows elevated risk characteristics:

• Abuse Density: 0.8164 (high_abuse classification)
• Total Subnet IPs: 256
• Active Siblings: 191
• Threat Siblings: 209
• Inherited Risk Score: 32

Risk Distribution in /24:

• High Risk: 0
• Medium Risk: 100
• Low Risk: 0

This indicates a highly utilized hosting subnet with significant abuse potential in the neighborhood.

## Observation History

24 observations recorded as of June 15, 2026:

• Subnet Abuse Density: 0.8164 (high_abuse)
• Network Classification: OVH hosting infrastructure
• Geolocation Validation: Plausible (473.7 km from probe, 87-95ms RTT)
• Operator Score: 0.2174 (Minimal)
• Threat Persistence: 0 days observed

## Related Entities

Network Relationships

• Multiple associations to OVH network OVH_282347337
• Same Network classification across all 26 relationship entries

DNS Associations

• Single hostname: proxy-uk001-san150.ahrefs.net (15 relationship entries)

## Recommendations

1. Monitoring: Given the high-abuse neighborhood classification, monitor for outbound connections from this subnet even without direct threat indicators.

2. Block Assessment: The moderate risk score (40) and 1/8 DNSBL listings warrant selective blocking depending on threat context. Consider blocking if this IP appears in attack traffic.

3. Geofencing: IP is geolocated to London, GB. Verify if this aligns with legitimate business expectations for your organization.

4. Subnet-Level Controls: The /24 subnet shows 81.64% abuse density. Implement broader subnet-level controls if this IP exhibits malicious behavior.

5. No Immediate Block Required: Absence of open ports, known campaigns, or direct attacker indicators suggests this may be legitimate hosting infrastructure.

---

Classification: Moderate Risk

Last Updated: Based on most recent observation data

Data Source: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.