198.244.242.37📋 Copy

# IP Intelligence Briefing: 198.244.242.37/32

Classification: Moderate Risk | Date: 2026-06-28

## Executive Summary

IP address 198.244.242.37 is a cloud hosting infrastructure address owned by Ahrefs Pte Ltd, operated through OVH network. The IP resolves to ahosting domain (ahrefs.net) with PTR hostname proxy-uk007-san37.ahrefs.net. While the IP itself shows no active threat indicators or known malicious activity, the /24 subnet demonstrates elevated abuse characteristics with a 0.6523 abuse density classification.

## Ownership and Infrastructure

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: London, England, GB
• Infrastructure Type: CloudCompute (Cloud-hosted)
• Network Classification: Hosting Provider
• CIDR Block: 198.244.128.0/17 (Origin BGP Prefix)

## Network Classification

• Provider: OVH
• Connection Type: Cloud infrastructure
• Status: Firewalled / No Services (no open ports detected)
• CDN/Proxy/Tor: Not identified as CDN, VPN, proxy, or Tor exit
• Anycast: No

## DNS Analysis

• PTR Hostname: proxy-uk007-san37.ahrefs.net
• Forward Resolution: Confirmed (ahrefs.net)
• Domain: ahrefs.net
• CAA Records: Present (1 issuer)
• DNSSEC: Valid
• Email Authentication: SPF and DMARC records not configured

## Threat Assessment

• Risk Score: 40 (Moderate Risk)
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• Threat Indicators: None
• Known Campaigns: None
• DNSBL Status: Listed on 1 of 8 DNSBL providers

## Neighborhood Analysis (198.244.242.0/24)

• Abuse Density: 0.6523 (High Abuse Classification)
• Total Siblings: 256 IPs
• Active Siblings: 219
• Threat Siblings: 167
• Risk Distribution: 37 Medium, 63 Low, 0 High
• Inherited Risk Score: 26

The /24 subnet shows significant abuse activity with 167 threat siblings out of 219 active IPs. This elevated neighborhood risk should be considered when evaluating traffic from this subnet.

## Observation History

• Total Observations: 22 signals
• Most Recent: 2026-06-28 11:45:33 UTC
• Ownership Stability: 0 changes recorded
• Provider Consistency: OVH (consistent across observations)
• Subnet Classification: Consistently classified as high_abuse

## Security Recommendations

Based on the moderate risk profile and subnet abuse density:

1. Monitor, Not Block: The IP itself shows no active threat indicators. No immediate blocking is recommended.

2. Traffic Baseline: Establish baseline traffic patterns for this IP given its hosting nature and subnet abuse characteristics.

3. Subnet Awareness: Exercise caution when evaluating other IPs from 198.244.242.0/24 subnet due to 0.6523 abuse density.

4. DNS Reputation: The IP is associated with ahrefs.net, a legitimate SEO analytics service. False positives are possible.

5. Geographic Context: Traffic originates from London, GB. Verify if this aligns with expected operational patterns.

## Risk Indicators

• Primary Concern: Subnet abuse density (0.6523)
• Secondary Concern: DNSBL listing (1 of 8 providers)
• Mitigating Factors: No known attacks, no spam indicators, established legitimate domain ownership

---

*Intelligence generated by IPDebrief platform. Data accuracy dependent on source feed completeness. For operational decisions, correlate with internal threat intelligence and traffic patterns.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.