198.244.168.89📋 Copy

# IP Intelligence Briefing: 198.244.168.89/32

Classification: Moderate Risk (Score: 40)

Date of Analysis: 2026-06-14

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP 198.244.168.89 is a cloud compute infrastructure address hosted by OVH in London, GB. The IP resolves to ahrefs.net and is associated with Ahrefs Pte Ltd Dmytro. While the individual IP shows no direct malicious indicators, it resides within a subnet exhibiting high abuse density (0.6445). The asset is currently firewalled with no open services detected.

---

## Technical Profile

Ownership & Registration

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Location: London, England, GB (RIR: ARIN)
• BGP Prefix: 198.244.128.0/17

Network Classification

• Infrastructure Type: CloudCompute
• Hosting Provider: OVH
• Connection Type: Cloud
• Service Status: Firewalled / No Services Detected
• Anycast: No
• Bogon: No

DNS Analysis

• PTR Hostname: proxy-uk001-san89.ahrefs.net
• Forward Resolution: ahrefs.net
• CAA Records: Present
• DNSSEC Valid: Yes

---

## Threat Indicators

Direct Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Abuse Confidence Score: Not Available

Control Plane Assessment

• Operator Score: 0.2174 (Minimal)
• Route Stability: False
• IRR Consistency: Not Evaluated
• RPKI State: Not Evaluated

---

## Neighborhood Analysis (198.244.168.0/24)

Subnet Risk Profile

• Abuse Density: 0.6445 (High)
• Classification: high_abuse
• Total Siblings: 256
• Active Siblings: 152
• Threat Siblings: 165
• Inherited Risk: 25

Risk Distribution

• High Risk: 0
• Medium Risk: 100
• Low Risk: 0

All neighbors in the /24 subnet consistently display risk scores of 40 with authority scores of 50, indicating uniform risk characteristics across the shared hosting environment.

---

## Temporal Analysis

Observation History

• Total Observations: 22
• Threat Observation Count: 1
• Threat Persistence Days: 0
• Is Persistently Malicious: No

Recent signals indicate network abuse classification updates and DNS resolution changes. The IP has shown no persistent malicious behavior over the observation period.

---

## Recommended Actions

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 198.244.168.89 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.168.89 drop

# nginx

deny 198.244.168.89;

```

WAF/Cloud Rules

• Cloudflare WAF: Block with description "IPDebrief risk score 40"
• AWS WAF: Add 198.244.168.89/32 to blacklist
• pfSense: Block 198.244.168.89/32

---

## Intelligence Assessment

Risk Mitigation Status: LOW-MEDIUM

This IP presents moderate risk primarily due to subnet-level abuse density rather than direct malicious activity. The infrastructure belongs to Ahrefs, a legitimate SEO analytics company. However, the high abuse density of the /24 subnet suggests potential for abuse by other tenants in the shared hosting environment.

Recommended Monitoring Actions

1. Monitor for new threat indicators in the 198.244.168.0/24 subnet

2. Consider blocking the entire /24 subnet if business justification exists

3. Monitor for lateral movement patterns from related OVH infrastructure

4. Review recent scan activity and service enumeration attempts

Threat Level: Moderate - Monitor with existing controls

Action Priority: Low-Medium - Block if business case supports full subnet filtering

---

*Report generated by IPDebrief Intelligence Team. All data sourced from IPDebrief platform.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.