198.244.242.134📋 Copy

# IP Intelligence Briefing: 198.244.242.134/32

## Executive Summary

IP address 198.244.242.134 is a low-risk cloud infrastructure endpoint operated by Ahrefs Pte Ltd on OVH hosting in London, GB. While the individual IP presents minimal threat characteristics, the /24 subnet demonstrates elevated abuse density requiring contextual monitoring.

## Risk Assessment

• Overall Risk Score: 25/100 (Low Risk)
• Reputation Classification: Low Risk
• Abuse Confidence: No active threat indicators
• Blacklist Presence: 0 blacklist hits

## Infrastructure Profile

• Organization: Ahrefs Pte Ltd Dmytro (ASN 16276)
• Hosting Provider: OVH CloudCompute
• Location: London, England, GB (750km accuracy radius)
• Infrastructure Type: Cloud infrastructure with hosting services
• Network Role: Firewalled/no active services exposed

## Network Context

• DNS Resolution: proxy-uk007-san134.ahrefs.net
• Reverse DNS: Confirmed ahrefs.net domain association
• Control Plane: Origin ASN 16276, BGP prefix 198.244.128.0/17
• Route Stability: Flagged as not stable (route changes observed)

## Neighborhood Intelligence (198.244.242.0/24)

• Subnet Abuse Density: 0.3242 (elevated)
• Threat Siblings: 83 out of 256 total IPs
• Risk Distribution: 0 high-risk, 76 medium-risk, 24 low-risk
• Notable Neighbors: Multiple IPs in 198.244.242.x range with risk scores 40-50

## Threat Indicators

• Tor Exit: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: None detected
• Cert Matches: 0
• Banner Matches: 0

## Historical Observations

• Total Signals: 22 observations recorded
• Recent Activity: DNS resolution signals and infrastructure classification
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0 changes observed

## Recommended Actions

1. Allow Traffic: No blocking required; IP is legitimate Ahrefs infrastructure

2. Monitor Subnet: Track 198.244.242.0/24 due to 83 threat siblings

3. No Firewall Rules: No immediate blocking or rate limiting recommended

4. Contextual Awareness: Monitor for any anomalous activity from this subnet given elevated neighborhood abuse density

## Conclusion

This IP represents legitimate SEO tool infrastructure with low individual risk. The primary intelligence value is contextual—the /24 subnet demonstrates mixed classification with significant threat sibling presence. SOC teams should monitor subnet-level patterns but can treat this specific IP as low-risk trusted infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.