198.244.242.19📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 198.244.242.19/32

Classification: Moderate Risk (Score: 40/100)

Date: 2026-06-20

Intel Level: Definitive

---

## EXECUTIVE SUMMARY

IP address 198.244.242.19 is a cloud-hosted infrastructure node operated by OVH (ASN 16276) for Ahrefs Pte Ltd. The IP presents moderate risk with a score of 40, resolved to a proxy hostname in London, UK, and is hosted within a high-abuse density subnet (198.244.242.0/24). The IP is listed on 1 of 8 DNS blacklists. No active threat indicators detected; the IP appears to be a legitimate proxy service endpoint with firewalling active.

---

## OWNERSHIP & GEOLOCATION

---

## NETWORK INFRASTRUCTURE

• Infrastructure Type: CloudCompute
• Hosting Status: Active (isHosting: true)
• Connection Type: Firewalled/No Services
• Open Ports: None detected
• DNS PTR: proxy-uk007-san19.ahrefs.net
• Forward Resolution: ahrefs.net (1 hostname)
• TLS Certificates: None detected
• BGP Prefix: 198.244.128.0/17 (Origin ASN: 16276)

---

## THREAT ASSESSMENT

Risk Profile

• Overall Risk Score: 40/100 (Moderate)
• Abuse Confidence Score: Not calculated
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Threat Indicators

• Blacklist Count: 1 of 8 DNS blacklists
• Threat Feeds: No active indicators
• Control Plane: Route stable, RPKI state pending
• Threat Observation Count: 1

Neighborhood Analysis (198.244.242.0/24)

• Subnet Abuse Density: 0.6406 (High)
• Total Siblings: 256 IPs
• Active Siblings: 206
• Threat Siblings: 164
• Risk Distribution: 40% Low, 60% Medium, 0% High
• Inherited Risk: 25/100

---

## OBSERVATION HISTORY

Total observations: 19 signals recorded across 2026-06-20. Key signals include:

• Network Classification: Provider identified as OVH, confirmed as cloud/hosting infrastructure
• DNS Resolution: ahrefs.net domain with CAA records present
• Geolocation: Multi-signal inference placed IP in GB with 0.28 confidence
• Operator Score: 0.2174 (Minimal)
• No malicious service banners or open ports observed

---

## RELATIONSHIP ANALYSIS

• Same Network Relationships: 43 relationships identified, primarily OVH network associations
• Target Network: OVH_282347343 (repeated association)
• No certificate or hostname relationships detected
• No correlated IPs in threat campaigns

---

## RECOMMENDED ACTIONS

Immediate Mitigation

Blocking recommended due to subnet-level abuse density and blacklist presence.

---

## INTELLIGENCE CONCLUSION

The IP 198.244.242.19 is a legitimate proxy endpoint for Ahrefs infrastructure hosted on OVH cloud services. While not exhibiting active malicious behavior, the IP resides within a high-abuse subnet (64% abuse density) and has been listed on DNS blacklists. Given the subnet-level threat concentration and the presence of 164 threat-sibling IPs, defensive blocking is recommended at the perimeter or application layer. The IP appears operational as a proxy service (firewalled, no open ports) and does not indicate active compromise or command-and-control activity.

Assessment: Monitor or block based on organizational threat tolerance. Subnet-level context suggests elevated risk despite individual IP cleanliness.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.