198.244.242.79📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 198.244.242.79/32

Date: 2026-06-20

Classification: MODERATE RISK - DEFENSIVE MONITORING RECOMMENDED

---

## EXECUTIVE SUMMARY

IP 198.244.242.79 presents a moderate-risk profile (Risk Score: 50) hosted on OVH cloud infrastructure in London, UK. The IP resolves to Ahrefs.net infrastructure with PTR hostname proxy-uk007-san79.ahrefs.net. Despite the authoritative domain association, the IP exhibits moderate threat indicators including DNSBL listings (2 of 8 total lists) and operates within a high-abuse-density subnet (198.244.242.0/24). No active threat campaigns or known malicious indicators were identified.

---

## NETWORK OWNERSHIP & GEOLOCATION

The IP is geographically consistent with claimed London positioning. Geo validation shows plausible location with 473.7 km distance from probe origin.

---

## THREAT INDICATORS

Current Risk Profile:

• Risk Score: 50 (Moderate)
• Blacklist Count: 2 DNSBL listings
• Abuse Confidence Score: Not available
• Is Known Attacker: False
• Is Spam Source: False
• Known Campaigns: None identified

DNS Security Status:

• DNSSEC Valid: Yes
• Has CAA Records: Yes
• Has SPF Record: No
• Has DMARC Record: No
• DNSBL Listed Count: 2 of 8 total lists

Network Classification:

• Is Cloud: Yes (OVH)
• Is CDN: No
• Is Proxy: No
• Is Tor: No
• Is Hosting: Yes
• Service Purpose: Firewalled / No Services
• Open Ports: None detected

---

## SUBNET ANALYSIS

Subnet: 198.244.242.0/24

• Abuse Density: 0.5078 (High abuse classification)
• Total Siblings: 256
• Active Siblings: 165
• Threat Siblings: 130
• Inherited Risk: 20

The parent subnet exhibits elevated abuse density with 50.78% of neighbors flagged with moderate-to-high risk scores. This contextual information suggests shared infrastructure usage patterns that may require monitoring.

---

## OBSERVATION HISTORY

Total Observations: 24 signals over monitoring period

Recent Activity Timeline:

• 2026-06-20: Geolocation signal observed (75% confidence) - London positioning confirmed
• 2026-06-17: DNS blacklist listings detected (8 total lists, 2 active, high severity)
• 2026-06-15: Operator score assessment (0.2174 - Minimal operator risk)
• 2026-06-08: DNS CAA records confirmed for ahrefs.net domain

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: No
• Route Stability: Unstable (isRouteStable: false)

---

## RELATIONSHIP GRAPH

Connected Entities: 42 relationships identified

• Same Network: Multiple references to OVH_282347343 network block
• BGP Prefix: 198.244.128.0/17
• Domain: ahrefs.net

The IP maintains standard cloud infrastructure relationships with no anomalous connections to known malicious entities.

---

---

## NEIGHBORHOOD ANALYSIS

Subnet Overview: 198.244.242.0/24

• Abuse Density: 0.5078 (High abuse classification)
• Risk Distribution:

- High Risk: 0

- Medium Risk: 100

- Low Risk: 0

• Neighbor Count: 100 sampled
• Inherited Risk Score: 20

Sample Neighbor Risk Profiles:

The subnet demonstrates consistent moderate-risk patterns across peer addresses, with no high-severity outliers detected in sampling.

---

## CAMPAIGN CORRELATION

Campaign Assessment:

• Likelihood: None
• CERT Matches: 0
• Banner Matches: 0
• Correlated IPs: 0
• CERT Subjects: None

No active threat campaigns or banner-based correlations identified. The IP does not appear to be part of known coordinated attack groups or botnet operations.

---

## CONTROLLER PLANE ANALYSIS

Routing Information:

• Origin ASN: 16276
• BGP Prefix: 198.244.128.0/17
• RPKI State: Not available
• IRR Consistency: Not available
• Route Changes (30d): 0
• Route Stability: Unstable
• MOAS Status: Not available

DNS Infrastructure:

• DNSSEC Valid: Yes
• Has CAA: Yes
• Delegation Age: Not available
• RIR Registry: ARIN

---

## ACTIONS & RECOMMENDATIONS

Current Risk Score: 50 (Moderate)

Recommendations: None specified by automated analysis

Suggested Firewall Rules (Based on Risk Score):

Implementation Note: These recommendations are probabilistic and should be combined with other signals before taking action.

---

## CONCLUSION

IP 198.244.242.79 is a cloud-hosted address associated with OVH infrastructure in London, UK. While the IP resolves to legitimate Ahrefs.net infrastructure, the subnet exhibits elevated abuse density and the address maintains 2 DNSBL listings. No active malicious activity or campaign associations were identified during this analysis period.

Recommended Actions for SOC Teams:

1. Monitor traffic patterns from this IP for anomalous behavior

2. Consider blocking at perimeter if organizational policy requires suppression of moderate-risk IPs

3. Review DNSBL listings for context on specific abuse categories

4. Correlate with internal threat detection alerts if activity is observed

Status: ACTIVE MONITORING RECOMMENDED

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.