198.244.168.34📋 Copy

# INTELLIGENCE BRIEFING: 198.244.168.34/32

Classification: Moderate Risk Cloud Infrastructure

Date: 2026-06-15

Analyst: IPDebrief Threat Intelligence

## Executive Summary

IP address 198.244.168.34 is a cloud-hosted infrastructure endpoint associated with Ahrefs Pte Ltd, operating within OVH network infrastructure in London, England. The IP carries a moderate risk score of 40/100 and demonstrates no direct malicious activity indicators. However, the IP operates within a high-abuse density subnet (0.7695), suggesting potential collateral risk from neighboring addresses. No threat indicators, known campaigns, or blacklist hits were observed.

## Profile Details

## Network Intelligence

Geolocation Analysis:

Geovalidation confirms plausible location in London with minimum possible RTT of 9.47ms and average RTT of 96.8ms across 5 probe attempts.

DNS Resolution:

• PTR Hostnames: proxy-uk001-san34.ahrefs.net
• Forward Resolution: proxy-uk001-san34.ahrefs.net
• Domain: ahrefs.net
• Forward Confirmation: Not resolved (forwardConfirmed: false)

Network Classification:

• Is Cloud: Yes
• Is CDN: No
• Is Hosting: Yes
• Is Tor/VPN/Proxy: No
• Is Bogon: No
• Is Anycast: No

Routing Analysis:

• BGP Prefix: 198.244.128.0/17
• Origin ASN: 16276
• AS Path: 57866 16276
• Route Stability: Stable (0 route changes in 30 days)
• IRR Consistency: Match
• DNSSEC Valid: Yes

## Neighborhood Assessment

Subnet: 198.244.168.34/24

Abuse Density: 0.7695 (High Abuse Classification)

Inherited Risk: 30/100

The /24 subnet contains 256 total sibling IPs with 191 active siblings and 197 classified as threats. Risk distribution shows 100 medium-risk neighbors and 0 high-risk neighbors. Sample neighbor risk scores:

• 198.244.168.0: 40 (Medium)
• 198.244.168.1: 40 (Medium)
• 198.244.168.2: 40 (Medium)

This indicates the subnet operates in a moderately abused cloud environment, likely hosting legitimate services with occasional abuse.

## Threat Indicators

## Historical Observations

24 signal observations recorded. Key temporal patterns:

Recent Signal (2026-06-15 08:48):

• Subnet abuse density: 0.7695
• Classification: high_abuse
• Inherited risk: 30
• Operator score: 0.6087 (Moderate)

Network Role Signal (2026-06-09 01:21):

• Identified as: CloudCompute
• Provider: OVH
• Is CDN: No

Ownership and network classification have remained stable with no ownership changes observed.

## Relationship Graph

37 relationships identified, primarily "Same Network" type associations with network identifier OVH_282347337. No external hostname, certificate, or organization relationships beyond the primary network association.

## Recommended Actions

Risk Score: 40/100 (Moderate)

Recommended Firewall Rules:

Assessment: No direct threat indicators were observed. The moderate risk score (40) combined with high-abuse subnet classification warrants monitoring but does not indicate active malicious activity. Consider implementing rate limiting or geo-based filtering if legitimate traffic patterns are observed from this IP range.

Action Priority: LOW-MONITOR — No immediate threat action required. Monitor for behavioral changes given neighborhood abuse density.

---

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.