198.244.242.157📋 Copy

# IP Intelligence Briefing: 198.244.242.157

## Executive Summary

IP address 198.244.242.157 is registered to Ahrefs Pte Ltd and operates on OVH cloud infrastructure in London, GB. Current risk assessment indicates moderate risk (score: 50/100) with no active threat indicators but elevated neighborhood abuse density.

## Technical Profile

Ownership & Geolocation:

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Location: London, England, GB (accuracy: 750km radius)
• RIR: ARIN

Network Role Classification:

• Infrastructure Type: CloudCompute
• Provider: OVH
• Status: Cloud-hosted infrastructure with hosting services enabled
• Service Status: Firewalled / No open ports detected

DNS Configuration:

• PTR Hostname: proxy-uk007-san157.ahrefs.net
• Forward Resolution: 1 hostname (forward confirmed: false)
• CAA Records: Present
• DNSSEC: Valid

## Threat Indicators

Current Status:

• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Abuse Signals:

• DNSBL Listings: 2 of 8 total lists (control plane data)
• Abuse Confidence Score: Null
• Historical high-severity DNSBL listing observed (June 28, 2026)

## Neighborhood Analysis

Subnet: 198.244.242.0/24

• Abuse Density Classification: High abuse (0.6523)
• Total Siblings: 256
• Active Siblings: 219
• Threat Siblings: 167
• Inherited Risk Score: 26

Risk Distribution in /24:

• High Risk: 0
• Medium Risk: 53
• Low Risk: 47

Control Plane:

• BGP Prefix: 198.244.128.0/17
• Route Stability: False
• Route Changes (30d): 0
• RPKI State: Not assessed

## Observation History

Total Observations: 22

Recent Signals:

• June 28, 2026: Cloud infrastructure classification (OVH), DNSBL listings with high severity
• June 20, 2026: High abuse density classification noted, DNS records confirmed for ahrefs.net

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: No
• Threat Observation Count: 1

## Recommended Security Actions

Immediate Recommendations:

Assessment Notes:

• No open ports or services detected (infrastructure may be intentionally firewalled)
• High neighborhood abuse density warrants monitoring of adjacent IPs in /24
• Historical data indicates DNSBL activity requiring correlation with internal logs
• Cloud infrastructure classification suggests legitimate hosting but requires baseline traffic analysis

## Conclusion

IP 198.244.242.157 presents moderate risk primarily due to elevated neighborhood abuse density rather than direct threat indicators. SOC teams should monitor traffic patterns from this IP and consider blocking based on organizational policy. Correlate with internal logs to determine if the IP represents legitimate Ahrefs traffic or potential abuse.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.