198.244.183.0📋 Copy

## IP INTELLIGENCE BRIEFING: 198.244.183.0/32

Date: 2026-06-27

Classification: LOW RISK

Risk Score: 25/100

---

EXECUTIVE SUMMARY

IP 198.244.183.0 is a cloud computing infrastructure endpoint operated by Ahrefs Pte Ltd (ASN 16276) within OVH hosting infrastructure in London, England. The IP demonstrates minimal malicious activity with a low-risk profile. No active threat indicators, campaigns, or known attacker signatures were detected.

---

OWNERSHIP & GEOLLOCATION

---

THREAT ASSESSMENT

Current Risk Indicators:

• Abuse Confidence: Null
• Blacklist Count: 0
• Known Campaigns: None detected
• Tor Exit Node: False
• Spam Source: False

Control Plane Analysis:

• BGP Prefix: 198.244.128.0/17
• Route Stability: Unstable
• DNSSEC: Valid
• Operator Score: 0.2174 (Minimal)
• DNSBL Listed: 1 of 8 lists

---

NETWORK CONTEXT & NEIGHBORHOOD

Subnet Analysis (198.244.183.0/24):

• Abuse Density: 0.4258 (moderate)
• Total Siblings: 256
• Active Siblings: 212
• Threat Siblings: 109
• Risk Distribution: High: 0, Medium: 77, Low: 23

The subnet shows mixed classification with moderate abuse density. No high-risk neighbors identified in immediate vicinity.

---

OBSERVATION HISTORY

Signal Timeline (23 observations):

• 2026-06-27: Minimal operator score (0.087), comprehensive profile signal across 6 dimensions
• 2026-06-25: Port scanning activity detected (8 ports scanned)
• 2026-06-25: Network classification confirmed as OVH hosting infrastructure
• 2026-06-25: DNS resolution to ahrefs.net verified

Persistence Metrics:

• Threat Persistence Days: 0
• Threat Observation Count: 1
• Ownership Changes: 0
• Persistently Malicious: False

---

TECHNICAL SERVICES

---

SOC RECOMMENDATIONS

Current Actions: No specific blocking or monitoring recommendations required.

Contextual Considerations:

1. Legitimate Infrastructure: IP belongs to Ahrefs SEO analytics platform. Allowlist consideration may be appropriate if internal systems reference ahrefs.net

2. Subnet Context: Monitor subnet 198.244.183.0/24 for elevated activity given 109 threat-sibling IPs present

3. Historical Activity: No escalation trend observed in signal history

4. DNSBL Presence: 1 DNSBL listing requires investigation if inbound traffic patterns indicate abuse

Priority: LOW

---

Intelligence Source: IPDebrief Platform

Data Freshness: Real-time (as of 2026-06-27)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.