198.244.242.255📋 Copy

# IP Intelligence Briefing: 198.244.242.255/32

Classification: Moderate Risk (Score: 40)

Report Date: 2026-06-14

Prepared For: SOC Operations

## Executive Summary

The IP address 198.244.242.255 is a cloud-based infrastructure endpoint owned by Ahrefs Pte Ltd (Organization: Ahrefs Pte Ltd Dmytro, ASN: 16276, OVH) located in London, England. The address registers as a firewalled/cloud host with no active services and moderate reputation risk. No active threat indicators were observed, though the associated /24 subnet exhibits elevated abuse density.

## Infrastructure Profile

## Threat Indicators

• Blacklist Status: 1 DNSBL listing (out of 8 total lists)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Active Threats: None detected
• Campaign Matches: 0
• Known Campaigns: None

## Network Neighborhood Analysis

The /24 subnet (198.244.242.0/24) demonstrates elevated abuse characteristics:

• Abuse Density: 60.94% (high_abuse classification)
• Total Siblings: 256 IPs
• Active Siblings: 205 IPs
• Threat Siblings: 156 IPs
• Inherited Risk Score: 24
• Neighbor Risk Distribution: 100 medium-risk IPs, 0 high-risk, 0 low-risk

## Historical Observations

The IP has generated 23 historical observations with the following key findings:

• Subnet Classification: Consistently classified as high_abuse (abuse_density: 0.6094)
• Provider Consistency: OVH infrastructure
• Geolocation Confidence: 28% confidence for GB location
• Route Stability: Route changes detected (isRouteStable: false)
• Threat Persistence: 0 days of persistent malicious activity
• Ownership Changes: 0 ownership changes recorded

## Control Plane Analysis

• BGP Prefix: 198.244.128.0/17
• Origin ASN: 16276
• RPKI State: Not validated
• DNSSEC Valid: Yes
• Operator Score: 0.2174 (Minimal)
• DNSBL Listed Count: 1

## Security Recommendations

Based on the moderate risk profile and elevated neighborhood abuse density, the following actions are recommended:

1. Monitor Closely: The IP shows moderate risk with no active threats, but the high-abuse /24 subnet warrants continued monitoring

2. Traffic Analysis: Review inbound/outbound traffic patterns for anomalous behavior given the neighborhood context

3. Firewall Rules: Consider rate limiting for traffic from this /24 subnet given the 60.94% abuse density

4. Geolocation Validation: Verify the claimed London, GB location against actual traffic sources

## Risk Assessment

The IP presents a moderate risk profile typical of legitimate cloud hosting infrastructure used by Ahrefs. While no active threat indicators were detected, the elevated abuse density in the neighborhood suggests this subnet may be shared among multiple tenants with varying risk profiles. SOC analysts should monitor for behavioral anomalies rather than blocking the address outright.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.