198.244.168.23📋 Copy

## IPDEBRIEF INTELLIGENCE BRIEFING

Target: 198.244.168.23/32

Classification: Moderate Risk / Hosting Infrastructure

Date: Current analysis based on available signal data

---

Executive Summary

The IP address 198.244.168.23 is a cloud-hosting infrastructure endpoint operated by OVH (AS16276) on behalf of Ahrefs Pte Ltd Dmytro. Located in London, England (GB), the endpoint shows moderate risk characteristics with a risk score of 50. The IP is associated with high-abuse-density subnet 198.244.168.0/24 and has multiple DNSBL listings (2 of 8 total). No active malicious indicators or known campaign affiliations are currently observed.

---

Technical Profile

Ownership & Infrastructure:

• AS: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Network: 198.244.128.0/17
• Infrastructure Type: Cloud compute / Hosting
• Status: Active, firewalled/no services exposed

Geolocation:

• Country: GB (England, London)
• GeoSource Confidence: Consensus-based (1 source)
• Accuracy Radius: 750 km

Network Classification:

• Cloud Provider: Yes (OVH)
• CDN: No
• VPN/Proxy: No
• Tor Exit: No
• Spam Source: No
• Known Attacker: No

---

Threat Indicators

Current Risk Assessment:

• Overall Risk Score: 50 (Moderate)
• Abuse Confidence Score: Not calculated
• Blacklist Count: 0 (current profile)
• DNSBL Listings: 2 of 8 total lists
• Threat Indicators: None detected

DNS Reputation:

• PTR Hostname: proxy-uk001-san23.ahrefs.net
• Forward Resolution: Confirmed (1 hostname)
• Email Auth: SPF/DMARC not configured
• Domain: ahrefs.net

---

Neighborhood Analysis

Subnet: 198.244.168.0/24

• Abuse Density: 0.8438 (HIGH)
• Classification: high_abuse
• Total Siblings: 256
• Active Siblings: 208
• Threat Siblings: 216
• Inherited Risk Score: 33

Risk Distribution in Subnet:

• High Risk: 0
• Medium Risk: 11
• Low Risk: 89

*Note: Despite low immediate risk for this specific IP, the subnet exhibits elevated abuse density requiring contextual awareness.*

---

Relationship Graph

Network Associations:

• Multiple entries mapped to network identifier: OVH_282347337

DNS Associations:

• Primary hostname: proxy-uk001-san23.ahrefs.net
• Multiple DNS association records observed

No Additional Relationships:

• No certificates detected
• No correlated IPs identified
• No campaign affiliations

---

Historical Trends

Observation Count: 21 signals

Key Historical Findings:

• 2026-06-28: Recent control plane signals detected (routing, operator classification)
• 2026-06-20: Network classification confirmed (OVH), abuse density measured at 0.8438, geolocation confirmed as GB
• Risk Stability: No persistent malicious behavior detected
• Ownership Changes: 0 (stable ownership)
• Threat Persistence: 0 days

Risk Trajectory: Stable. No significant escalation or de-escalation of risk signals over observed period.

---

Recommended Actions

Monitoring Recommendations:

1. Monitor DNS Activity: The PTR hostname (proxy-uk001-san23.ahrefs.net) indicates this is a proxy/service endpoint. Monitor for anomalous DNS queries.

2. Subnet Awareness: Given the high abuse density (0.8438) of the 198.244.168.0/24 subnet, maintain elevated situational awareness for related IPs.

3. DNSBL Watch: Track changes in DNSBL listing status (currently 2 of 8 lists).

Firewall/Blocking Considerations:

• Immediate Action: No immediate blocking required. Risk score (50) is moderate, not malicious.
• Contextual Decision: If traffic is from 198.244.168.23, verify legitimacy against known Ahrefs services.
• Subnet Consideration: Consider blocking or rate-limiting if the subnet's high abuse density correlates with your organization's threat profile.

No Recommended Blocks: The IP does not meet criteria for immediate blocking based on current threat indicators.

---

SOC Analyst Notes

This endpoint appears to be legitimate cloud hosting infrastructure. The moderate risk score is primarily driven by the high-abuse-density subnet environment rather than direct malicious activity. No known campaigns, attacker indicators, or spam characteristics are associated with this IP.

Key Indicators for Correlation:

• ASN: 16276
• Domain: ahrefs.net
• PTR: proxy-uk001-san23.ahrefs.net
• BGP Prefix: 198.244.128.0/17

Final Assessment: Monitor with standard procedures. No immediate threat action required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.