198.244.168.40📋 Copy

## IP Intelligence Briefing: 198.244.168.40/32

Classification: Moderate Risk / Cloud Infrastructure

Date of Assessment: Current

---

Executive Summary

IP address 198.244.168.40 is a cloud-hosted infrastructure endpoint associated with OVH (ASN: 16276) operating within a high-abuse subnet environment. The IP is registered under Ahrefs Pte Ltd Dmytro and resolves to proxy-uk001-san40.ahrefs.net. While the IP shows no active threat indicators, it operates in a subnet with 75.39% abuse density and has been listed on 1 of 8 DNS blocklists.

---

Technical Profile

• IP Address: 198.244.168.40
• Risk Score: 40/100 (Moderate Risk)
• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: London, England, GB (reported from multiple sources with 750km accuracy radius)
• Network Role: Cloud Compute / Hosting Infrastructure
• DNS Resolution: proxy-uk001-san40.ahrefs.net (ahrefs.net domain)
• Service Status: Firewalled / No Open Ports Detected
• TLS/Certificate: Not available

---

Threat Indicators & Reputation

• Blacklist Status: Listed on 1 DNSBL out of 8 total lists monitored
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Active Threat Campaigns: None detected
• Operator Score: 0.2174 (Minimal)
• Route Stability: Unstable (route changes detected in 30-day window)

---

Neighborhood Analysis

The IP resides in subnet 198.244.168.0/24 with significant abuse correlation:

• Abuse Density: 0.7539 (High)
• Subnet Classification: high_abuse
• Active Siblings: 191 of 256 IPs
• Threat Siblings: 193 IPs with threat indicators
• Neighbor Risk Distribution: 100 medium-risk IPs (risk score: 40)

This indicates the IP is embedded within a heavily utilized OVH hosting environment with elevated abuse activity.

---

Historical Observations

• Total Observations: 23 signal events recorded
• Latest Activity: 2026-06-20 (DNS resolution, control plane data)
• Previous Notable Observation: 2026-06-15 (subnet abuse density confirmation, OVH ASN association)
• Threat Persistence: 0 days (no persistent malicious activity detected)

Geolocation data has shown some inconsistency between GB (primary) and FR (OVH headquarters) across different signal sources.

---

Relationships

• Network Associations: 34 relationships identified, primarily same-network connections to OVH infrastructure (OVH_282347337)
• No certificate or hostname relationships detected
• No correlated IPs or campaign links

---

Recommended Actions

• Firewall Rules: No specific blocking recommended; monitor for abuse patterns
• Monitoring: Track for DNS query anomalies and outbound connection attempts
• Context: Legitimate cloud hosting IP for Ahrefs; false positives possible due to high-abuse subnet environment
• Threshold: Consider blocking if outbound connections originate from this IP to external command-and-control infrastructure

---

Intelligence Assessment

This IP represents legitimate cloud hosting infrastructure for a known SEO analytics company (Ahrefs). However, the high-abuse subnet environment and single DNSBL listing suggest potential for false-positive abuse reports. No evidence of active malicious use has been detected. SOC analysts should monitor for behavioral changes but may classify as low-priority for immediate blocking.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.