198.244.183.242📋 Copy

## IPDEBRIEF INTELLIGENCE BRIEFING

Target IP: 198.244.183.242/32

Classification: Moderate Risk (Score: 40)

Date of Analysis: 2026-06-14

Data Sources: IPDebrief Enterprise

---

EXECUTIVE SUMMARY

IP address 198.244.183.242 is a cloud compute endpoint operated by OVH (ASN 16276) within the Ahrefs Pte Ltd Dmytro organization. The IP resolves to hostname proxy-uk004-san242.ahrefs.net and is geolocated to London, England. Risk assessment indicates moderate threat level (score 40) primarily attributable to high-abuse neighborhood conditions rather than intrinsic malicious behavior. No active threat indicators, open services, or known malicious activity were detected.

---

NETWORK OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH SAS)
• Organization: Ahrefs Pte Ltd Dmytro
• Provider: OVH (Cloud Compute)
• Registration: ARIN
• CIDR Block: 198.244.128.0/17 (BGP Prefix)
• Infrastructure Type: Cloud Compute / Hosting
• Status: Active, Route Stable: No

---

GEOLOCATION DATA

---

THREAT ASSESSMENT

Overall Risk Score: 40 (Moderate)

Risk Breakdown:

• Threat Indicators: None detected
• Abuse Confidence Score: Not applicable
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None

Control Plane Data:

• DNSBL Listed: 1 of 8 total lists
• Route Changes (30d): 0
• Route Stability: False
• RPKI State: Not available
• IRR Consistency: Not available

---

NEIGHBORHOOD ANALYSIS (198.244.183.0/24)

Assessment: The /24 subnet exhibits high abuse density (69.92%), with 179 of 256 total IPs flagged as threat siblings. This contextual risk significantly influences the target IP's risk classification.

---

DNS & SERVICE ANALYSIS

Email Authentication:

• SPF Record: Not found
• DMARC Record: Not found
• TXT Record Count: 0

---

OBSERVATION HISTORY (Last 24 Observations)

Key Signals:

• Abuse Classification: High abuse (0.6992 density) — 2026-06-14 18:14:52
• ASN Attribution: AS16276 ovh sas (FR) — 2026-06-14 18:14:52
• DNS Records: ahrefs.net (CAA records present) — 2026-06-14 18:14:32
• Infrastructure Type: Cloud Compute, OVH provider — 2026-06-14 18:13:41
• Geolocation: GB (London) — 2026-06-14 18:13:42

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 1
• Persistently Malicious: No

---

RELATIONSHIP GRAPH

Total Relationships: 60

Primary Relationships:

• Same Network: OVH_282347340 (55+ instances)

No cross-organization, certificate, or hostname relationships beyond network-level associations.

---

RECOMMENDED ACTIONS

Risk-Based Recommendations:

1. Firewall/Network Blocking:

- iptables: `iptables -A INPUT -s 198.244.183.242 -j DROP`

- nftables: `nft add rule inet filter input ip saddr 198.244.183.242 drop`

- Nginx: `deny 198.244.183.242;`

- pfSense: `198.244.183.242/32`

2. WAF Rules:

- Cloudflare WAF: Block with expression `ip.src eq 198.244.183.242`

- AWS WAF: Add `198.244.183.242/32` to blocked addresses

3. Contextual Considerations:

- IP associated with legitimate Ahrefs infrastructure

- No open services detected (reduces exploitation vector)

- No specific threat indicators beyond neighborhood context

- Consider blocking subnet-level (198.244.183.0/24) if abuse threshold warrants

---

INTELLIGENCE CONCLUSION

IP 198.244.183.242 presents moderate risk (score 40) primarily due to high-abuse neighborhood classification rather than intrinsic malicious behavior. The IP is properly registered to Ahrefs Pte Ltd Dmytro on OVH infrastructure with no open services and no detected threat indicators. SOC analysts should weigh the neighborhood abuse density (69.92%) against the legitimate organizational ownership before implementing blocking measures. Recommend monitoring for any changes in service state or threat indicator emergence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.