198.244.168.44📋 Copy

## INTELLIGENCE BRIEFING: 198.244.168.44/32

EXECUTIVE SUMMARY

IP address 198.244.168.44 is classified as Moderate Risk (Score: 40). The IP is associated with OVH cloud infrastructure (ASN 16276) and resolves to Ahrefs.net. Despite legitimate DNS resolution, the IP demonstrates elevated risk characteristics through subnet-level abuse indicators and DNSBL listings.

TECHNICAL PROFILE

• Risk Score: 40 (Moderate)
• Network Provider: OVH (ASN 16276)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: London, England, GB (473.7km from probe, 82-85ms RTT)
• Infrastructure: CloudCompute/Hosting environment
• DNS Records: proxy-uk001-san44.ahrefs.net (ahrefs.net)
• Services: No open ports or active services detected
• BGP Prefix: 198.244.128.0/17
• DNSBL Status: Listed on 1 of 8 total blacklists

THREAT INDICATORS

• Abuse Confidence: Elevated subnet-level risk
• DNSBL Presence: 1 listing detected
• Campaign Correlation: No known campaign associations
• Tor/Proxy: Not identified as Tor exit node, proxy, or VPN
• Malicious Classification: Not flagged as known attacker or spam source

SUBNET ANALYSIS (198.244.168.0/24)

• Classification: High Abuse
• Abuse Density: 0.8164 (81.64%)
• Active Siblings: 191 of 256 total IPs
• Threat Siblings: 209 IPs flagged as threats
• Risk Distribution: 100 medium-risk neighbors, 0 high/low risk
• Inherited Risk Score: 32 (from subnet context)

OBSERVATION HISTORY

23 signal observations recorded. Key findings:

• Recent subnet classification shows abuse density of 0.8438 (high_abuse)
• Consistent high_abuse classification across multiple observations
• Port scanning activity detected in recent observations
• DNS resolution for ahrefs.net confirmed
• No persistent malicious behavior pattern identified
• Ownership stability: No changes observed

NETWORK RELATIONSHIPS

33 relationships identified, primarily network-level associations (OVH_282347337). Limited entity relationships detected beyond infrastructure-level connections.

RECOMMENDED ACTIONS

Based on risk assessment, the following firewall rules are recommended:

iptables: `iptables -A INPUT -s 198.244.168.44 -j DROP`

nftables: `nft add rule inet filter input ip saddr 198.244.168.44 drop`

nginx: `deny 198.244.168.44;`

pfSense: `198.244.168.44/32`

Cloudflare WAF: Block with expression `ip.src eq 198.244.168.44`

AWS WAF: Addresses `198.244.168.44/32`

INTELLIGENCE NARRATIVE

The IP address 198.244.168.44 operates within the OVH cloud infrastructure in London, UK. While DNS resolution indicates association with Ahrefs.net, the subnet exhibits significant abuse characteristics with an 81.64% abuse density and 209 threat-sibling IPs. The control plane shows BGP route stability issues despite the IP not being persistently malicious. DNSBL listings confirm the IP's association with spam or abuse activity. The recommended action is to implement blocking across perimeter defenses, though contextual analysis should confirm whether legitimate Ahrefs traffic should be allowed.

Classification: Moderate Risk - Monitor/Block Based on Environment

Priority: Medium

Confidence: 75% (based on subnet-level indicators and DNSBL presence)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.