198.244.242.63📋 Copy

IP Intelligence Briefing: 198.244.242.63

Date: 2026-06-14

---

**1. Core Profile**

• Reputation: Moderate Risk (Risk Score: 50)
• Ownership:

- ASN: 16276 (OVH)

- Organization: Ahrefs Pte Ltd Dmytro

- Geolocation: London, England, GB (plausible, 473.7km from probe)

• Network Role:

- CloudCompute infrastructure (OVH)

- Hosting service (firewalled, no public services)

• Threat Indicators:

- No direct malicious indicators (no blacklists, spam, or campaigns)

- Subnet abuse density: High (0.6094)

---

**2. Observation History (30 Days)**

• Geolocation Consistency: Plausible (London, GB) with RTT variance (87–92ms).
• Network Stability:

- BGP route stability: Unstable (route changes detected).

- DNSSEC validation: Valid,CAA records present.

• Behavioral Signals:

- No honeypot hits or suspicious TLS banners.

- DNS resolution: 1 confirmed PTR hostname (`proxy-uk007-san63.ahrefs.net`).

---

**3. Relationships & Subnet Analysis**

• Network Relationships:

- Linked to OVH network `OVH_282347343` (43+ relationships).

- Subnet: 198.244.242.63/24 (256 IPs, 194 active, 156 flagged as threats).

• Neighbor Risk:

- High abuse density (60.94% of subnet flagged).

- 100 neighbors analyzed: 100 IPs with moderate/high risk scores (avg. 45).

- Inherited risk: 24 (substantial exposure via shared subnet).

---

**4. Threat Context**

• No Direct Malicious Activity: IP itself shows no spam, C2, or known attacker patterns.
• Subnet Risk: High abuse density suggests potential for lateral movement or shared infrastructure compromises.
• Cloud Hosting Context: Likely used for legitimate services (e.g., Ahrefs proxies), but subnet risks warrant scrutiny.

---

**5. Recommendations**

• Monitor Subnet: Investigate high-risk neighbors for coordinated attacks or shared vulnerabilities.
• Segment Network: Consider isolating cloud resources to mitigate subnet-wide exposure.
• Verify DNS: Confirm ownership of `proxy-uk007-san63.ahrefs.net` to ensure no spoofing.
• Enhance Logging: Track DNS and BGP anomalies in the subnet for early threat detection.

SOC Action: Validate if the subnet is part of a broader compromise. Use firewall rules to restrict access to this subnet if not required.

---

*Data sourced from IPDebrief intelligence suite. Risk scores and classifications are based on aggregated threat signals.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.