198.244.242.167📋 Copy

## Threat Intelligence Briefing: 198.244.242.167/32

Summary:

The IP address 198.244.242.167 was associated with moderate-risk activity (risk score: 40) during observation. The address resided within OVH cloud infrastructure (ASN 16276) in London, England, operating under the Ahrefs organization entity. No active malicious indicators were present at the time of assessment.

Infrastructure Profile:

The address operated as a cloud compute resource with DNS resolution to proxy-uk007-san167.ahrefs.net under the ahrefs.net domain. No open ports or active services were detected, indicating the resource was either firewalled or inactive during scanning. The infrastructure operated as hosting infrastructure within the 198.244.128.0/17 BGP prefix.

Threat Assessment:

Threat indicators remained absent during the assessment period. The address did not appear on blacklists (blacklist count: 0), was not classified as a known attacker or spam source, and showed no association with Tor exit nodes. No known threat campaigns were correlated. The operator score was minimal (0.2174), suggesting limited network-level threat activity.

Subnet Context:

The 198.244.242.0/24 subnet exhibited high-abuse classification with an abuse density of 0.6484. Analysis of neighboring IPs revealed 166 threat-sibling addresses out of 256 total siblings, with 206 active siblings. Risk distribution across the subnet showed 100 medium-risk neighbors and 0 high-risk addresses. This suggests the subnet hosts legitimate infrastructure alongside compromised or misconfigured endpoints.

Observation History:

Twenty signal observations were recorded, with the most recent subnet abuse classification observed on 2026-06-15T09:08:59 UTC. DNS and operator signals were consistently observed alongside the subnet abuse classification. No ownership changes or persistent malicious behavior patterns were detected.

Relationship Analysis:

The IP maintained relationships with 13 instances of the same network (OVH_282347343) and 18 DNS associations to the proxy-uk007-san167.ahrefs.net hostname.

Recommended Actions:

No specific security actions or firewall rules were recommended based on the risk profile. The moderate-risk classification combined with the high-abuse subnet context suggests monitoring rather than blocking. The legitimate enterprise association (Ahrefs) and absence of direct threat indicators support maintaining connectivity while monitoring for changes in behavior.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.