198.244.168.76
IP Intelligence Briefing: 198.244.168.76
Date: 2026-06-15
---
**Core Profile**
- Reputation: Moderate Risk (Risk Score: 40)
- Ownership:
- ASN: 16276 (OVH)
- Organization: Ahrefs Pte Ltd Dmytro (Singapore)
- Geolocation: London, England, UK (ARIN registry)
- Network Role: CloudCompute infrastructure (OVH-hosted)
- Threat Indicators: No direct malicious activity detected.
---
**Subnet Analysis**
- Subnet: 198.244.168.0/24
- Abuse Density: 52.73% (high abuse classification)
- Neighbor Risk:
- 135/256 IPs in subnet flagged as threats (40% risk score average).
- 136 active IPs, 135 with threat indicators.
---
**Observation History**
- Temporal Trends:
- Stable risk profile since June 2026.
- Subnet abuse density increased from 0.5273 (June 8) to 0.6719 (June 15).
- Geolocation Plausibility: Inferred as London, UK (750km accuracy radius).
---
**Relationships**
- Connected Entities:
- DNS hostname: `proxy-uk001-san76.ahrefs.net` (Ahrefs domain).
- Shared subnet: OVH network (ASN 16276).
- No Correlated Malicious Campaigns or Certificates.
---
**Recommended Actions**
1. Monitor Subnet Traffic:
- Given the high abuse density in the subnet, implement network segmentation or firewall rules to restrict traffic from 198.244.168.0/24 to trusted internal systems.
2. Verify Ahrefs Infrastructure:
- Confirm if Ahrefs’ cloud compute instances are legitimate and ensure no unauthorized access to their infrastructure.
3. Check for Lateral Movement:
- Investigate if this IP is part of a larger compromised network, given the high threat sibling count in the subnet.
---
Conclusion:
The IP is part of a high-risk subnet associated with Ahrefs’ cloud infrastructure. While the IP itself shows no direct malicious activity, the surrounding network’s abuse density warrants closer scrutiny. SOC teams should prioritize monitoring this subnet for unusual traffic patterns or potential lateral movement.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Ahrefs Pte Ltd Dmytro |
| ASN | AS16276 |
| Network Name | — |
| CIDR Block | — |
| RIR | ARIN |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | proxy-uk001-san76.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-uk001-san76.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 29% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 12% | 2 | 2 |
| ownership | 20% | 2 | 3 |
| reputation | 28% | 1 | 3 |
| geolocation | 33% | 2 | 3 |
| Overall | 23% | 10 | 16 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-16 21:00:16 UTC |
| Last Seen | 2026-06-28 03:53:05 UTC |
| Profile Built | 2026-06-28 21:58:22 UTC |
| Data Freshness | Live |
| Signal Types | 23 |
| Total Observations | 27 |
Full dossier details are available via our API.