198.244.168.168📋 Copy

# IP Intelligence Briefing: 198.244.168.168/32

## Executive Summary

IP 198.244.168.168 is classified as MODERATE RISK (score 40/100). The address is hosted on OVH infrastructure in London, GB, but operates within a high-abuse subnet (198.244.168.0/24) showing significant threat activity. No active threat indicators detected against this specific IP, but contextual neighborhood risk warrants monitoring.

## Profile Details

• Risk Score: 40 (Moderate Risk)
• ASN: 16276 (OVH SAS)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: London, England, GB
• Infrastructure Type: CloudCompute / Hosting
• DNS PTR: proxy-uk001-san168.ahrefs.net (ahrefs.net)
• Network Role: Firewalled / No Services Detected

## Neighborhood Analysis

The IP resides in subnet 198.244.168.0/24, classified as HIGH ABUSE:

• Abuse Density: 0.8359 (elevated)
• Threat Siblings: 214 of 256 total IPs
• Active Siblings: 208
• Inherited Risk Score: 33

## Threat Indicators

• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Listings: 1 of 8 total lists
• Campaign Association: None detected

## Technical Observations

• DNSSEC: Valid
• CAA Records: Present
• Operator Score: 0.2174 (Minimal)
• Control Plane Status: Route unstable
• Geolocation Consensus: False (conflicting FR/GB reports in history)

## Recommended Actions

Based on risk profile, the following blocking rules are recommended for defensive filtering:

```bash

# iptables

iptables -A INPUT -s 198.244.168.168 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.168.168 drop

# Cloudflare WAF

Expression: ip.src eq 198.244.168.168 → Block

# AWS WAF

Addresses: [198.244.168.168/32]

```

## Intelligence Assessment

This IP presents moderate risk primarily due to its high-abuse subnet environment. While the specific IP shows no active threat signatures, the neighborhood's 83.6% abuse density suggests potential for related malicious activity. The hosting infrastructure (cloudcompute) combined with firewalled status indicates legitimate hosting operations, but the subnet-level risk warrants inclusion in threat monitoring. Recommend blocking at perimeter controls and monitoring for related activity from the /24 subnet.

---

*Report generated: 2026-06-21 | Data sources: IPDebrief intelligence platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.