198.244.183.121📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 198.244.183.121/32

Classification: Moderate Risk / High Abuse Neighborhood

Date of Assessment: 2026-06-21

---

## EXECUTIVE SUMMARY

IP address 198.244.183.121 is hosted on OVH cloud infrastructure (ASN 16276) in London, England. The IP resolves to the Ahrefs.net domain (proxy-uk004-san121.ahrefs.net) but presents as "Firewalled / No Services" with no open ports detected. While the IP itself carries a moderate risk score (50), it resides within a high-abuse density subnet (0.8008 abuse density) with 205 threat-sibling IPs identified in the /24. The IP is listed on 2 of 8 DNSBLs with max severity "high."

---

## TECHNICAL PROFILE

---

## THREAT INDICATORS

• Blacklist Status: Listed on 2 of 8 DNSBLs
• Max Severity: High
• Abuse Confidence: Not quantified
• Known Campaigns: None correlated
• Campaign Likelihood: Not assessed
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

---

## NEIGHBORHOOD ANALYSIS

Subnet: 198.244.183.121/24

• Abuse Density: 0.8008 (High abuse classification)
• Total Subnet IPs: 256
• Active Siblings: 211
• Threat Siblings: 205
• Inherited Risk Score: 32

The subnet exhibits significant abuse activity. 205 of 211 active IPs in the /24 are classified as threats. This elevated neighborhood risk should factor into threat assessment decisions.

---

## NETWORK CLASSIFICATION

• Cloud Provider: OVH (confirmed)
• Infrastructure Type: CloudCompute
• Hosting: Yes
• CDN: No
• Proxy: No
• VPN: No
• Bogon: No
• Anycast: No
• Mobile/Residential: No

---

## OBSERVATION HISTORY (18 observations)

Recent signals from 2026-06-21 indicate:

• DNS Resolution: ahrefs.net (CAA records present)
• Geolocation: GB (confidence 0.28, 750km accuracy)
• Abuse Density: 0.8008 (high_abuse classification)
• Operator Score: 0.2174 (Minimal)
• DNSSEC: Valid
• CAA Records: Present

---

## RELATIONSHIP GRAPH

• Network: OVH_282347340 (31 relationship entries)
• DNS Associations: proxy-uk004-san121.ahrefs.net (multiple entries)
• No organization/hosting provider relationships detected

---

## RECOMMENDED ACTIONS

Firewall Recommendations:

---

## ANALYST NOTES

1. Context: IP resolves to legitimate Ahrefs domain but is firewalled with no active services

2. Risk Factor: Despite moderate IP-level risk (50), the subnet abuse density (0.8008) and 205 threat siblings suggest elevated neighborhood risk

3. Recommendation: Implement blocking per firewall rules, particularly given high-abuse subnet classification and DNSBL listings

4. Monitoring: Monitor for new DNSBL listings or service activity emergence

5. False Positive Consideration: Legitimate Ahrefs infrastructure may be flagged by DNSBLs; evaluate business context before permanent blocking

---

*This briefing was generated using IPDebrief intelligence tools. Recommendations should be validated against organizational threat context before implementation.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.