198.244.242.96📋 Copy

# IP Intelligence Briefing: 198.244.242.96/32

Classification: Moderate Risk (Score: 50/100)

Analysis Date: 2026-06-20

Status: Active Threat Indicators Present

---

## Executive Summary

IP 198.244.242.96 is a cloud infrastructure address hosted by OVH (ASN 16276) in London, GB. The IP is associated with Ahrefs Pte Ltd Dmytro and is part of a high-abuse subnet with significant threat activity. While currently showing no open services, the address carries moderate risk due to neighborhood abuse density, DNSBL listings, and control plane instability.

---

## Key Indicators

---

## Threat Assessment

The IP exhibits moderate risk characteristics consistent with cloud infrastructure hosting potentially malicious activity:

• Neighborhood Context: The /24 subnet (198.244.242.0/24) shows high abuse density (0.6641) with 170 of 256 sibling IPs identified as threats. This IP inherits a risk score of 26 from neighborhood context.
• Control Plane: Route instability detected; BGP prefix 198.244.128.0/17 shows 0 route changes in 30 days but is classified as not stable. RPKI state and IRR consistency data unavailable.
• Network Role: Firewalled with no open services. No TLS certificates, HTTP banners, or scanable ports detected.
• Geolocation: Inferred location London, GB with 750km accuracy radius based on multi-signal inference (confidence: 0.28).

---

## Historical Observations

Recent signal history (last 20 observations) indicates:

• Persistent subnet abuse classification (0.6641 density, high_abuse)
• Consistent OVH provider identification
• Minimal operator score (0.2174)
• Operator label: "Minimal"
• No persistent malicious activity detected over observation period

---

## Related Entities

• Network: OVH_282347343 (41 relationships identified)
• Subnet: 198.244.242.96/24 (256 total siblings, 219 active)
• Threat Siblings: 170 IPs in subnet flagged as threats
• Risk Distribution in /24: High (0), Medium (24), Low (76)

---

## Recommended Actions

Based on risk profile, the following firewall rules are recommended:

---

## SOC Analyst Notes

• Block Recommendation: Moderate priority. IP is part of a high-abuse subnet with multiple threat indicators.
• Context: Hosted on OVH cloud infrastructure under Ahrefs Pte Ltd Dmytro. PTR hostname suggests proxy service.
• Monitoring: Subnet-wide abuse density warrants monitoring of additional /24 addresses.
• False Positive Consideration: DNSBL listings (2/8) and operator score may indicate some legitimate use cases. Evaluate against business requirements before permanent blocking.

---

Data Source: IPDebrief Intelligence Platform

Confidence Level: Moderate (risk score 50)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.