198.244.168.87
IP Intelligence Briefing: 198.244.168.87
Date: 2026-06-14
---
**1. Core Profile**
- Risk Score: 40 (Moderate Risk)
- Ownership: Ahrefs Pte Ltd Dmytro (ASN 16276, ARIN registered)
- Geolocation: London, England, UK (plausible, 750km accuracy radius)
- Network Role: CloudCompute infrastructure (OVH-hosted, no public services detected)
- Threat Indicators: No active malware, phishing, or spam associations.
---
**2. Subnet Analysis**
- Subnet: 198.244.168.0/24
- Abuse Density: 64.45% (high-risk classification)
- Neighbor Risk: 100 neighboring IPs (165 flagged as threats, 256 total).
- Key Observations:
- 40% of subnet IPs show moderate to high risk.
- 151 active IPs, 165 linked to threats.
- Inherited risk score: 25 (substantial local abuse).
---
**3. Historical Trends**
- Observation Count: 1 (recently detected).
- Risk Stability: No significant changes in threat signals.
- Geolocation Consensus: Valid (RTT: 377–514ms, 5 probes).
---
**4. Relationships**
- Linked Entities:
- Network: OVH_282347337 (same provider, 36 relationships).
- Domains: `ahrefs.net` (CAA records, no DNS anomalies).
- Services: No open ports, no TLS/HTTP services detected.
---
**5. Recommendations**
- Monitor Subnet: High abuse density in 198.244.168.0/24 warrants closer scrutiny.
- Check Hosting Activity: OVH CloudCompute instances may host compromised services.
- Block Neighbor IPs: Consider restricting traffic from high-risk subnet siblings.
- Verify Ownership: Confirm Ahrefs’ IP usage compliance with ARIN policies.
---
Conclusion:
198.244.168.87 is a low-risk IP owned by Ahrefs, but its subnet exhibits high abuse density. While no direct threats are detected, the surrounding network may pose risks. SOC teams should monitor for lateral movement or compromised neighbors.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Ahrefs Pte Ltd Dmytro |
| ASN | AS16276 |
| Network Name | — |
| CIDR Block | — |
| RIR | ARIN |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | proxy-uk001-san87.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-uk001-san87.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 29% | 2 | 4 |
| routing | 15% | 2 | 2 |
| services | 12% | 2 | 2 |
| ownership | 24% | 2 | 3 |
| reputation | 31% | 1 | 3 |
| geolocation | 35% | 2 | 3 |
| Overall | 24% | 11 | 17 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-07 23:04:06 UTC |
| Last Seen | 2026-06-27 02:38:43 UTC |
| Profile Built | 2026-06-27 20:44:54 UTC |
| Data Freshness | Live |
| Signal Types | 26 |
| Total Observations | 31 |
Full dossier details are available via our API.