198.244.242.175📋 Copy

# IP Intelligence Briefing: 198.244.242.175/32

## Executive Summary

IP address 198.244.242.175 presents a moderate risk profile (score: 40) associated with cloud infrastructure hosted by OVH in London, England. The IP operates under the ahrefs.net domain but demonstrates concerning neighborhood-level abuse patterns with a high-abuse subnet classification (198.244.242.0/24).

## Risk Assessment

Overall Risk Score: 40 (Moderate Risk)

Infrastructure Type: Cloud Compute / Hosting

Provider: OVH (ASN 16276)

Registration: Ahrefs Pte Ltd Dmytro

Key Risk Indicators

• DNSBL listed: 1 of 8 total blacklist checks (high severity)
• Operator score: 0.2174 (labeled "Minimal")
• Subnet abuse density: 0.6641 (classified as high_abuse)
• Inherited risk from neighborhood: 26

## Geographic and Network Context

Location: London, England, GB

Timezone: Europe/London

BGP Prefix: 198.244.128.0/17

Route Stability: False (0 route changes in 30 days)

DNSSEC: Valid

## Infrastructure Analysis

• Infrastructure Classification: Cloud Compute, Hosting
• Connection Type: Firewalled / No Services
• DNS Resolution: proxy-uk007-san175.ahrefs.net (ahrefs.net)
• Open Ports: None detected
• TLS Certificate: Not observed
• HTTP Services: Not active

## Neighborhood Intelligence (198.244.242.0/24)

• Total Siblings: 256
• Active Siblings: 227
• Threat Siblings: 170
• Risk Distribution: High (0), Medium (22), Low (78)
• Classification: High abuse subnet

The subnet exhibits elevated malicious activity with 170 threat siblings out of 227 active IPs. Multiple neighboring addresses show risk scores between 25-50, indicating systemic abuse patterns within the /24 block.

## Historical Observations (22 Total Signals)

Recent signal history reveals:

• June 2026: Cloud infrastructure detection (OVH)
• June 2020: High-abuse subnet classification signals
• DNSBL Activity: 1 listing recorded with high severity
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0 (stable ownership)

## Relationship Graph

37 relationships detected, primarily network-level associations with OVH infrastructure (OVH_282347343). No certificate, organization, or hostname relationships beyond the network level were identified.

## Threat Indicators

• Campaign Correlation: None
• Known Attacker: False
• Tor Exit Node: False
• Proxy/VPN: False
• Spam Source: False
• Threat Feeds: None matched

## Recommended Security Actions

Firewall Rules

iptables:

```

iptables -A INPUT -s 198.244.242.175 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 198.244.242.175 drop

```

nginx:

```

deny 198.244.242.175;

```

Cloud/WAF Recommendations

• Cloudflare WAF: Block IP with expression `ip.src eq 198.244.242.175`
• AWS WAF: Add 198.244.242.175/32 to blocked address set
• pfSense: 198.244.242.175/32

## Analyst Notes

While the individual IP (198.244.242.175) shows no direct threat indicators or active malicious services, the high-abuse subnet classification (170 threat siblings) warrants defensive blocking. The moderate risk score of 40 combined with DNSBL presence and neighborhood abuse patterns suggests potential for compromised or misconfigured infrastructure in the same /24 block. Consider implementing subnet-level controls for 198.244.242.0/24 where operational requirements permit.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.