198.244.242.150📋 Copy

IP Intelligence Briefing: 198.244.242.150

Date: 2026-06-08

---

**1. Core Profile**

• Risk Score: 25 (Low Risk)
• Ownership: Registered to Ahrefs Pte Ltd (ASN 16276, OVH provider).
• Geolocation: London, England, UK (residential/business use).
• Network Role: Cloud compute instance (OVH infrastructure).
• Threat Indicators: No malicious activity detected (no malware, phishing, or exploit campaigns).

---

**2. Observation History**

• Recent Activity:

- Linked to ahrefs.net (DNS resolver for proxy subdomains).

- Subnet 198.244.242.0/24 shows moderate abuse density (43.75%).

- Geolocation inferred via RTT analysis (473.7 km from probe, 90.6ms avg latency).

• Trend: Stable risk profile with no significant changes over the past 30 days.

---

**3. Relationships & Network Context**

• Associated Entities:

- Hostname: `proxy-uk007-san150.ahrefs.net` (DNS-resolved to this IP).

- Subnet Neighbors: 256 IPs in 198.244.242.0/24, with 112 flagged as high/medium risk.

- Provider: OVH cloud infrastructure (ASN 16276).

• Network Classification: Mixed-use subnet (legitimate services and potential abuse).

---

**4. Neighborhood Analysis**

• Subnet Abuse Density: 43.75% (moderate risk).
• Neighbor Risk Distribution:

- 70% low risk, 30% medium/high risk.

- 112 neighbors flagged for suspicious activity.

• Recommendation: Monitor neighboring IPs for unusual traffic patterns.

---

**5. Threat & Mitigation Context**

• Threat Likelihood: No active campaigns or malicious indicators.
• Mitigation Actions:

- No immediate blocking required; IP is part of legitimate cloud infrastructure.

- Consider monitoring traffic to/from `ahrefs.net` subdomains for anomalies.

• Firewall Rules: No specific rules recommended due to low risk.

---

**6. Summary**

The IP 198.244.242.150 is a low-risk cloud compute instance operated by Ahrefs, registered to OVH. While the subnet exhibits moderate abuse density, the IP itself shows no malicious activity. SOC teams should focus on monitoring related subdomains (`ahrefs.net`) and neighboring IPs for potential lateral movement or network compromise. No immediate action is required, but ongoing vigilance is advised.

Next Steps:

• Validate DNS records for `proxy-uk007-san150.ahrefs.net`.
• Monitor subnet neighbors for spikes in risk.
• Correlate with other network traffic to detect anomalies.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.