198.244.168.96📋 Copy

# IP Intelligence Briefing: 198.244.168.96

Date: June 19, 2026

Classification: Moderate Risk / Cloud Infrastructure

Risk Score: 40/100

## Executive Summary

IP 198.244.168.96 is a cloud-compute endpoint associated with Ahrefs Pte Ltd (AS16276), hosted in London, England. The IP operates on OVH infrastructure and presents moderate-risk characteristics with a reputation score of 40. While no direct threat indicators were identified, the IP resides within a high-abuse-density subnet (0.8242) containing 211 malicious siblings.

## Technical Profile

Ownership & Registration:

• ASN: 16276 (OVH SAS)
• Organization: Ahrefs Pte Ltd Dmytro
• RIR: ARIN
• CIDR Block: 198.244.128.0/17

Geolocation:

• Country: United Kingdom (GB)
• Region: England
• City: London
• Timezone: Europe/London
• Accuracy Radius: 750 km
• Distance from probe origin: 473.7 km

Network Classification:

• Infrastructure Type: Cloud Compute
• Is Cloud: True
• Is Hosting: True
• Is CDN/Proxy/VPN: False
• Service Purpose: Firewalled / No Services
• Open Ports: None detected

## DNS Analysis

• PTR Hostname: proxy-uk001-san96.ahrefs.net
• Forward Confirmed: False
• Hosted Domain: ahrefs.net
• Forward Resolution Count: 1
• DNSSEC Valid: True
• Has CAA Record: True

## Threat Indicators

• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False
• Blacklist Count: 0
• DNSBL Listed: 1 of 8 total lists
• Known Campaigns: None
• Threat Feeds: None
• Pulsedive Risk: Not available

## Neighborhood Assessment

Subnet: 198.244.168.0/24

• Classification: High Abuse
• Abuse Density: 0.8242 (82.42%)
• Total Siblings: 256
• Active Siblings: 199
• Threat Siblings: 211
• Risk Distribution: 100 medium-risk IPs

The subnet exhibits elevated abuse activity with 82.4% of addresses showing malicious behavior. This contextualizes the moderate-risk profile of the target IP.

## Relationship Graph

• Connected Network: OVH_282347337 (45 relationship entries)
• Network Affiliation: Multiple Same Network relationships detected

## Historical Observations

Total Signals: 28 observations recorded

Most Recent: June 19, 2026

Operator Score: 0.2609 (Basic classification)

Route Stability: Unstable (isRouteStable: False)

Threat Persistence: 0 days

Ownership Changes: 0

Signal history indicates consistent basic-level classification with no significant escalation in threat indicators over the observation period.

## Recommended Security Actions

Based on risk profile and neighborhood context, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 198.244.168.96 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 198.244.168.96 drop

```

nginx:

```

deny 198.244.168.96;

```

pfSense:

```

198.244.168.96/32

```

Cloudflare WAF:

```json

{"description":"Block 198.244.168.96 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 198.244.168.96"}}

```

AWS WAF:

```json

{"Addresses":["198.244.168.96/32"],"Description":"IPDebrief risk 40"}

```

## Intelligence Assessment

The IP presents moderate-risk characteristics typical of cloud-hosting infrastructure. While the target IP itself shows no direct threat indicators, the high-abuse neighborhood density warrants consideration of blocking or monitoring. The association with Ahrefs suggests legitimate use cases, but the subnet's abuse profile indicates potential collateral exposure.

Recommended Action: Monitor traffic patterns and implement block rules pending further contextual analysis.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.