198.244.168.173📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target IP: 198.244.168.173/32

Classification: Moderate Risk

Date: 2026-06-14

---

## EXECUTIVE SUMMARY

IP 198.244.168.173 is a hosting infrastructure endpoint owned by Ahrefs Pte Ltd Dmytro, hosted on OVH UK infrastructure in London. The IP demonstrates moderate risk (score: 40) with no active threat indicators. While the subnet exhibits elevated abuse density, the specific IP shows no malicious activity and maintains legitimate service associations.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: London, England, GB (750km accuracy radius)
• Network Block: 198.244.128.0/17
• Infrastructure Type: Hosting (Firewalled/No Services)
• Cloud/Proxy/VPN: Not detected

---

## DNS & RESOLUTION

• PTR Hostname: proxy-uk001-san173.ahrefs.net
• Forward Resolution: ahrefs.net domain
• Reverse Confirmation: Unverified
• DNSSEC Valid: Yes
• CAA Records: Present
• DNSBL Listed: 1 of 8 total lists

---

## THREAT ASSESSMENT

Threat Indicators: None detected. IP shows no evidence of malicious activity.

---

## NETWORK CONTEXT

Subnet Analysis (198.244.168.0/24):

• Abuse Density: 0.668 (High Abuse Classification)
• Inherited Risk Score: 26
• Active Siblings: 164 of 256
• Threat Siblings: 171
• Neighbor Risk Distribution: All neighbors show risk score 40

Observation: The subnet exhibits elevated abuse density typical of large hosting environments. However, the specific IP does not show malicious behavior despite the neighborhood context.

---

## TEMPORAL ANALYSIS

• Total Observations: 23
• Threat Persistence Days: 0
• Ownership Changes: 0
• Most Recent Signal: 2026-06-14T23:19:52+00:00
• Persistence Status: Not persistently malicious

---

## RECOMMENDED ACTIONS

SOC Analyst Actions:

1. Monitor but Do Not Block: IP represents legitimate Ahrefs infrastructure with no active threats

2. Allow Standard Traffic: No firewall rules recommended

3. Log Connection Activity: Monitor for anomalous patterns despite low-risk profile

4. Consider Subnet Context: Be aware of elevated abuse density in the /24 block

Firewall Rules: None required. IP demonstrates normal hosting behavior with appropriate DNS resolution to ahrefs.net infrastructure.

---

## INTELLIGENCE NOTES

The IP resolves to a proxy hostname within Ahrefs' UK infrastructure. While the broader subnet shows high abuse density (171 threat siblings), this specific endpoint maintains clean threat indicators. The single DNSBL listing appears to be a false positive or low-severity listing unrelated to active threats. Recommended approach: monitor, do not block.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.