198.244.168.192📋 Copy

# IP Intelligence Briefing: 198.244.168.192/32

## Executive Summary

IP address 198.244.168.192 was classified as a moderate risk endpoint (risk score: 50) with no direct threat indicators. The IP operates as a cloud-hosted proxy endpoint under OVH infrastructure in London, GB, associated with the ahrefs.net domain. Despite individual risk scoring, the subnet exhibits high abuse density (0.8438) with 216 of 256 sibling IPs flagged as threats.

## Network Profile

Ownership & Classification:

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Location: London, England, GB
• Infrastructure Type: CloudCompute
• Network Role: Hosting provider with no active services

DNS Resolution:

• PTR Record: proxy-uk001-san192.ahrefs.net
• Forward Resolution: Confirmed to ahrefs.net domain
• Email Authentication: SPF and DMARC records absent

Control Plane:

• BGP Prefix: 198.244.128.0/17
• Route Stability: Unstable (changes detected)
• DNSBL Listings: 2 out of 8 total lists
• RPKI State: Not evaluated
• DNSSEC: Valid

## Threat Assessment

Direct Threat Indicators:

• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No
• Is Proxy: No
• Active Threats: None detected
• Campaign Correlation: No matches

Subnet Context:

• Classification: high_abuse
• Abuse Density: 0.8438 (84.38%)
• Active Siblings: 208/256
• Threat Siblings: 216
• Inherited Risk Score: 33

## Historical Analysis

Observation history tracked 22 signal events. Recent probes (June 2026) maintained consistent cloud hosting classification under OVH. Geovalidation confirmed plausible London placement via multi-signal inference (5 probe points, average RTT: 93.8ms). No persistent malicious behavior observed over the observation period.

## Infrastructure Relationships

Relationship graph identified 43 connections, primarily same-network associations to OVH_282347337. No certificate, hostname, or organizational cross-links detected beyond network-level associations.

## Recommended Actions

Based on moderate risk classification and high-abuse subnet context, the following defensive controls are recommended:

Firewall Rules:

• iptables: `iptables -A INPUT -s 198.244.168.192 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 198.244.168.192 drop`

Application-Level Blocking:

• nginx: `deny 198.244.168.192;`
• pfSense: Block 198.244.168.192/32
• Cloudflare WAF: Block IP with expression `ip.src eq 198.244.168.192`
• AWS WAF: Add 198.244.168.192/32 to block list

## Intelligence Notes

The IP represents a legitimate cloud-hosted service endpoint (ahrefs.net) but operates within a high-abuse density subnet. While the endpoint itself shows no active malicious indicators, the subnet context warrants conservative blocking policies. SOC analysts should monitor for any behavioral changes from this IP, particularly given the unstable routing history and high sibling threat concentration.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.