198.244.168.222📋 Copy

# INTELLIGENCE BRIEFING: 198.244.168.222/32

Date: 2026-06-14

Classification: Moderate Risk / High Abuse Neighborhood

Threat Level: Elevated (Action Required)

---

## EXECUTIVE SUMMARY

IP address 198.244.168.222 was analyzed and classified as a moderate-risk address with a risk score of 40. The IP is hosted by OVH (ASN 16276) in London, England, and is associated with the organization "Ahrefs Pte Ltd Dmytro." The address demonstrates firewalled network behavior with no active services detected on open ports. While the IP itself shows no active threat indicators, its subnet environment exhibits elevated abuse density, warranting defensive monitoring.

---

## NETWORK OWNERSHIP & GEOLOCATION

Ownership:

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH)
• RIR: ARIN
• Abuse Contact: Available via RDAP

Geolocation:

• Country: GB (United Kingdom)
• Region: England
• City: London
• Accuracy Radius: 750km
• Geo Consensus: True

Network Role:

• Infrastructure Type: Hosting
• Connection Type: Firewalled / No Services
• CDN/Proxy/VPN Status: None detected

---

## DNS & INFRASTRUCTURE ANALYSIS

PTR Records:

• proxy-uk001-san222.ahrefs.net

DNS Characteristics:

• Forward Resolution: Confirmed (1 hostname)
• Forward Hostname: proxy-uk001-san222.ahrefs.net
• Domain: ahrefs.net
• CAA Records: Present
• DNSSEC Valid: True
• CAA Records: Present

Service Status:

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Server Banner: None

---

## THREAT INDICATORS & BLACKLIST STATUS

Threat Profile:

• Is Tor Exit Node: False
• Is Known Attacker: False
• Is Spam Source: False
• Blacklist Count: 0
• Known Campaigns: None
• Threat Feeds: None

Control Plane Data:

• DNSBL Listed Count: 1
• DNSBL Total Lists: 8
• Operator Score: 0.2174
• Route Stability: False
• BGP Prefix: 198.244.128.0/17

---

## NEIGHBORHOOD ANALYSIS

Subnet Profile (198.244.168.0/24):

• Abuse Density: 0.6562 (High)
• Classification: High Abuse
• Total Siblings: 256
• Active Siblings: 164
• Threat Siblings: 168
• Inherited Risk Score: 26

Neighbor Risk Distribution (Sampled 100):

• High Risk: 0
• Medium Risk: 100
• Low Risk: 0

Notable Neighbor Addresses:

• 198.244.168.0: Risk Score 40, Authority Score 50
• 198.244.168.1: Risk Score 40, Authority Score 50
• 198.244.168.2: Risk Score 40, Authority Score 50
• 198.244.168.3: Risk Score 40, Authority Score 50
• 198.244.168.4: Risk Score 40, Authority Score 50

---

## OBSERVATION HISTORY

Total Observations: 23 signals

Recent Activity (2026-06-14):

• 21:08:25 UTC: DNS resolution to ahrefs.net confirmed with 80% confidence
• 21:05:52 UTC: Certificate transparency search (CRT-Sh) with 0 certificates
• 21:05:38 UTC: Subnet abuse density signal showing high_abuse classification (0.6562)
• 21:04:48 UTC: Geographic inference placing IP in GB with 28% confidence
• 21:03:49 UTC: DNSBL listing signal with high severity across 8 lists

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 1
• Persistently Malicious: False

---

## RELATIONSHIP GRAPH

Total Relationships: 73 entities

Relationship Types Identified:

• Same Network: 70+ relationships pointing to OVH_282347337
• Additional entity types: Subnets, hostnames, organizations, certificates (not fully detailed)

---

## THREAT INTELLIGENCE ASSESSMENT

Risk Factors:

1. Neighborhood Contamination: The 198.244.168.0/24 subnet demonstrates high abuse density (0.6562) with 168 threat-sibling IPs out of 164 active siblings. This indicates the hosting provider's infrastructure segment may be compromised or abused.

2. DNSBL Presence: The IP is listed on 1 of 8 DNSBL lists, indicating prior abuse history or association with malicious activity.

3. Firewalled Status: No active services detected suggests the IP may be dormant, reserved, or intentionally firewalled, reducing immediate threat potential but requiring monitoring.

4. OVH Provider Context: The IP belongs to a large hosting provider with known abuse vectors in certain subnet segments.

Mitigating Factors:

• No active threat indicators (no known campaigns, no Tor association, no spam source classification)
• DNSSEC validation present
• CAA records configured
• No open ports or active services

---

## RECOMMENDED ACTIONS

SOC/DEFENSIVE ACTIONS:

1. Monitor Traffic Patterns: Implement logging and behavioral analysis for traffic to/from 198.244.168.222, particularly given the high-abuse neighborhood classification.

2. Subnet-Wide Assessment: Consider broader assessment of the 198.244.168.0/24 subnet due to 0.6562 abuse density. Prioritize IPs with risk scores of 40 or higher.

3. Connection Monitoring: Track any outbound connections from internal hosts to this IP for potential command-and-control activity.

4. DNSBL Monitoring: Maintain awareness of the 1 DNSBL listing and verify if the listing persists or expands.

FIREWALL/NETFLOW RULES:

• Log all traffic to/from 198.244.168.222
• Monitor for unusual connection patterns
• Consider rate-limiting inbound connections

PRIORITY: MEDIUM — While the IP itself shows no active threats, the high-abuse neighborhood context requires continued monitoring and potential subnet-wide defensive measures.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.