198.244.168.98📋 Copy

# IP Intelligence Briefing: 198.244.168.98/32

## Executive Summary

IP 198.244.168.98 is classified as Moderate Risk (risk score: 50) with a reputation profile indicating mixed threat characteristics. The address is hosted on OVH infrastructure in London, England (GB), and resolves to a Ahrefs-owned proxy hostname. While currently not flagged as a known attacker or spam source, the IP operates within a high-abuse density subnet environment.

## Profile Overview

## Technical Indicators

• DNS Resolution: proxy-uk001-san98.ahrefs.net (ahrefs.net domain)
• BGP Prefix: 198.244.128.0/17
• Origin ASN: 16276
• Route Stability: False (route changes detected within 30-day window)
• Service Status: Firewalled / No Services detected
• Open Ports: None identified
• TLS Certificates: None detected

## Threat Assessment

• Abuse Confidence: Not currently flagged as known attacker, spam source, or Tor exit node
• Blacklist Status: 2 DNSBL listings out of 8 total lists
• Campaign Correlation: No known campaign matches
• Threat Persistence: 0 threat persistence days (not persistently malicious)
• Control Plane Status: 0 route changes in 30 days, isRouteStable: false

## Neighborhood Analysis

The IP resides in subnet 198.244.168.0/24, characterized by:

• Abuse Density: 0.8203 (high abuse classification)
• Total Siblings: 256
• Active Siblings: 204
• Threat Siblings: 210
• Inherited Risk: 32

Risk Distribution in Subnet: 52 medium-risk, 48 low-risk, 0 high-risk IPs sampled.

## Historical Trends (22 Observations)

• June 20, 2026: Abuse density 0.8203, classification "high_abuse", inherited risk 32, threat siblings 210
• June 28, 2026: Abuse density decreased to 0.4609, classification shifted to "mixed", inherited risk 18, threat siblings 118
• Provider Detection: OVH hosting classification confirmed June 20, 2026
• Geolocation: Inferred GB with 750km accuracy radius

## Network Relationships

• 38 Relationships Detected: Multiple connections to network OVH_282347337
• Same Provider/Network: Confirmed OVH infrastructure association

## Recommended Actions

Based on risk profile and neighborhood context, the following firewall rules are recommended:

iptables: `iptables -A INPUT -s 198.244.168.98 -j DROP`

nftables: `nft add rule inet filter input ip saddr 198.244.168.98 drop`

nginx: `deny 198.244.168.98;`

Cloudflare WAF: Block with expression `ip.src eq 198.244.168.98`

AWS WAF: Add rule for address 198.244.168.98/32 with description "IPDebrief risk 50"

## Analyst Notes

This IP operates within a high-risk subnet environment (0.8203 abuse density) but shows declining threat signals over the observation period. While not currently flagged as active malicious infrastructure, the combination of hosting classification, high-abuse neighborhood context, and DNSBL listings warrants continued monitoring. Consider blocking at perimeter controls if traffic from this address correlates with suspicious activity. The subnet 198.244.168.0/24 should be evaluated for broader reputation assessment given the 210 threat siblings identified.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.