198.244.168.99📋 Copy

# IP Intelligence Briefing: 198.244.168.99/32

Date: 2026-06-15

Classification: Moderate Risk

Risk Score: 40/100

---

## Executive Summary

IP address 198.244.168.99 is a cloud-compute infrastructure endpoint associated with OVH (ASN 16276) hosting in London, United Kingdom. The endpoint is classified as a firewalled/no-services host with no direct active threat indicators, though it resides within a high-abuse-density subnet (0.8047) with 206 threat siblings identified in the /24 block.

---

## Risk Profile

• Risk Score: 40 (Moderate Risk)
• Provider: OVH (Cloud Computing Infrastructure)
• Registration: Ahrefs Pte Ltd Dmytro (ASN 16276)
• Geolocation: London, England, GB (750km accuracy radius)
• Infrastructure Type: CloudCompute / Hosting
• DNS Resolution: proxy-uk001-san99.ahrefs.net (ahrefs.net)

---

## Network Environment Assessment

The /24 subnet (198.244.168.0/24) exhibits high abuse classification with 0.8047 abuse density. Of 256 sibling IPs:

• Active: 191
• Threat Siblings: 206
• Inherited Risk: 32

Control plane analysis shows route stability issues with minimal operator score (0.2174). The IP is not Tor-related, not a known attacker, and shows zero blacklist hits.

---

## Behavioral History

21 signal observations recorded through 2026-06-15. Recent activity indicates:

• No persistent malicious behavior
• Ownership changes: 0
• Threat persistence days: 0
• DNSSEC valid with CAA records present

---

## Recommended Actions

Block Recommendations:

---

## Intelligence Narrative

The endpoint presents a moderate-risk profile characteristic of cloud infrastructure hosting. While no direct threat indicators are active, the high-abuse neighborhood context warrants monitoring. The IP is associated with Ahrefs.net domain infrastructure and appears to be part of a larger cloud-hosting operation. The firewalled/no-services status suggests the IP may be reserved, staging, or used for non-public-facing services.

Threat Context: The subnet's elevated abuse density (206 threat siblings) indicates potential association with compromised infrastructure or botnet activity. However, this specific IP shows no active malicious behavior in recent observations.

Recommendation: Block inbound traffic to this IP at perimeter firewalls. Monitor outbound connections if this IP appears in internal logs. Consider subnet-level blocking (198.244.168.0/24) if threat intelligence indicates broader campaign activity.

---

Generated by: IPDebrief Intelligence Platform

Analysis: Defensive Security Intelligence

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.