198.244.168.255
IP Intelligence Briefing: 198.244.168.255/32
*Generated for SOC Analysts*
---
**1. Core Profile**
- Risk Score: Moderate (40/100)
- Ownership: Ahrefs Pte Ltd (OVH ASN 16276)
- Geolocation: London, England, GB (high plausibility)
- Network Role: CloudCompute (OVH-hosted, no residential/mobile indicators)
- Threat Indicators: No direct malicious signals (no spam, attacks, or blacklists).
---
**2. Subnet Analysis**
- /24 Subnet: 198.244.168.0/24
- Abuse Density: 52.73% (high-risk classification)
- Neighbor Risk: 100 IPs analyzed (81 medium-risk, 19 low-risk).
- Notable Neighbors:
- 198.244.168.0 (risk 40), 198.244.168.1 (risk 25), and others with moderate risk.
- Inherited Risk: 21 (substantial risk from neighboring IPs).
---
**3. Network Relationships**
- Same Network: Linked to OVH network `OVH_282347337` (high abuse classification).
- DNS Associations:
- `proxy-uk001-san255.ahrefs.net` (Ahrefs hostname, likely a proxy service).
- No CDN/VPN/Tor Indicators: IP is a static cloud instance.
---
**4. Temporal Observations**
- Recent Activity (June 2026):
- Minimal risk inferred via DNSSEC and CAA records.
- High abuse classification in subnet persists.
- No significant threat persistence or malicious campaigns detected.
---
**5. Recommended Actions**
1. Monitor Subnet: High abuse density suggests potential for lateral movement or compromised neighbors.
2. Verify DNS: Investigate `proxy-uk001-san255.ahrefs.net` for DNS misconfigurations or hijacking.
3. Block/Allowlist:
- Consider blocking the subnet if it’s a known source of malicious activity.
- Allowlist the IP if it’s a legitimate cloud service (e.g., Ahrefs infrastructure).
4. Check for Anomalies: Correlate with SIEM for unusual traffic patterns in the subnet.
---
**6. Summary**
The IP is part of a high-risk subnet associated with Ahrefs, a legitimate company. While the IP itself shows no direct malicious activity, the surrounding network’s abuse density warrants closer scrutiny. SOC teams should prioritize monitoring the subnet for emerging threats and validate the IP’s role in the network.
*Generated by IPDebrief – Threat Intelligence for Defensive Operations.*
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Ahrefs Pte Ltd Dmytro |
| ASN | AS16276 |
| Network Name | — |
| CIDR Block | — |
| RIR | ARIN |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | proxy-uk001-san255.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-uk001-san255.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 39% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 15% | 2 | 2 |
| ownership | 24% | 2 | 3 |
| reputation | 31% | 1 | 3 |
| geolocation | 33% | 2 | 3 |
| Overall | 26% | 10 | 15 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-18 03:22:27 UTC |
| Last Seen | 2026-06-28 06:06:14 UTC |
| Profile Built | 2026-06-29 00:10:44 UTC |
| Data Freshness | Live |
| Signal Types | 21 |
| Total Observations | 24 |
Full dossier details are available via our API.