IPDebrief

198.244.183.123

IP Intelligence Dossier
Your IP: 216.73.216.123
{ } JSON 🔧 Full Actions API
🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

# THREAT INTELLIGENCE BRIEFING

## Target IP: 198.244.183.123/32

Date: 2026-06-20

Classification: Moderate Risk (Score: 40)

Provider: OVH (ASN 16276)

Location: London, England, GB

---

EXECUTIVE SUMMARY

IP address 198.244.183.123 resolves to cloud infrastructure operated by OVH in London, United Kingdom. While the individual IP shows no direct threat indicators (0 blacklist entries, no known campaigns), the IP resides within a subnet classified as "high_abuse" with 76.95% abuse density. The address is associated with the ahrefs.net domain and terminates with no open services.

---

RISK PROFILE

MetricValue
**Risk Score**40 (Moderate Risk)
**Abuse Confidence**Not scored (blacklist count: 0)
**Stability Score**0 (Unstable)
**Provider Score**0
**Authority Score**0
**Is Cloud**Yes (OVH)
**Is Hosting**Yes
**Service Status**Firewalled / No Services

---

GEOLOCATION & OWNERSHIP

---

NEIGHBORHOOD ANALYSIS — CRITICAL FINDING

The /24 subnet (198.244.183.123/24) exhibits elevated abuse characteristics:

MetricValue
**Abuse Density**76.95%
**Classification**high_abuse
**Total Siblings**256
**Active Siblings**190
**Threat Siblings**197
**Inherited Risk**30
**Risk Distribution**100 Medium Risk, 0 High, 0 Low

Assessment: The subnet shows statistically significant abuse prevalence. Of 100 sampled neighbors, all returned risk scores of 40. This contextual risk factor should be considered alongside the individual IP's moderate risk profile.

---

DNS & HOSTNAME RESOLUTION

FieldValue
**PTR Hostnames**proxy-uk004-san123.ahrefs.net
**Domain**ahrefs.net
**Forward Resolution**1 hostname
**Forward Confirmed**No
**DNSSEC Valid**Yes
**CAA Records**Yes
**Email Auth (SPF/DMARC)**Not configured

Note: The hostname pattern indicates this is an OVH-sanctioned proxy infrastructure endpoint for the ahrefs.net organization.

---

OBSERVATION HISTORY

Total observations: 19

Recent activity timeline:

Threat Persistence: No persistent malicious activity detected.

---

NETWORK RELATIONSHIPS

---

THREAT INDICATORS

IndicatorStatus
**Tor Exit Node**No
**Known Attacker**No
**Spam Source**No
**Blacklist Count**0
**Known Campaigns**None
**Threat Feeds**Empty

---

CONTROL PLANE ANALYSIS

MetricValue
**Operator Score**0.2174 (Minimal)
**DNSBL Listed**1 of 8 lists
**Route Stability**False
**Route Changes (30d)**0
**RPKI State**Not applicable
**IRR Consistency**Not applicable

---

RECOMMENDED ACTIONS

Based on risk profile and neighborhood context, the following controls are recommended:

PlatformRecommended Action
**iptables**`iptables -A INPUT -s 198.244.183.123 -j DROP`
**nftables**`nft add rule inet filter input ip saddr 198.244.183.123 drop`
**nginx**`deny 198.244.183.123;`

| pfSense | Block 198

198.244.183.123/32

PlatformRecommended Action
**pfSense**Block 198.244.183.123/32
**Cloudflare WAF**Block 198.244.183.123 (Risk Score 40)
**AWS WAF**Allowlist deny: 198.244.183.123/32

---

CONCLUSION

This IP address presents a moderate risk profile (Score: 40) with contextual neighborhood risk. The subnet 198.244.183.0/24 demonstrates high abuse density (76.95%) with 197 of 256 sibling IPs flagged as threat-siblings. While this individual IP shows no direct malicious activity and no known threat indicators, the elevated neighborhood risk suggests the infrastructure is frequently utilized for abusive purposes.

SOC Analyst Guidance:

---

END OF INTELLIGENCE BRIEFING

Source: IPDebrief Threat Intelligence Platform

Generated: 2026-06-20

Classification: SOC Internal Use Only

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

Country🇬🇧 United Kingdom
RegionEngland
CityLondon
TimezoneEurope/London
Latitude51.51
Longitude-0.13

🏢 Ownership & Registration

OrganizationAhrefs Pte Ltd Dmytro
ASNAS16276
Network Name—
CIDR Block—
RIRARIN
Country—
Abuse ContactAvailable via RDAP

🌐 DNS Intelligence

PTRproxy-uk004-san123.ahrefs.net
Forward ConfirmedNo — PTR hostname does not resolve back to this IP (weak signal)
Forward Hostnamesproxy-uk004-san123.ahrefs.net

🔐 DNS Hygiene

Hygiene Score40% (Fair)
SPFNot configured
DMARCNot configured
FCrDNSNot verified
DNSSECValid
CAAPresent

☁️ Network Classification

InfrastructureInfrastructure / Datacenter
Service PurposeFirewalled / No Services
Network TierHosting — Infrastructure provider without advanced routing
CloudHosting

🔌 Services & Open Ports

PortServiceProtocolBanner
No open ports detected
Closed Ports22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned)
Server—
HTTP Title—

🔐 TLS Certificate

🔒
No certificate
Issued by —
N/A
SANsNone
Valid From—
Valid Until—

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

DimensionScoreSourcesObservations
threat
34%
24
routing
13%
11
services
12%
22
ownership
24%
23
reputation
32%
13
geolocation
26%
22
Overall23%1015
Coverage: 6/6 dimensions · Data sufficiency: sufficient
Data CoherenceConsistent (100%)
AttributionModerate (50%)
OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

📅 Observation Timeline 🔄 Live

First Seen2026-05-22 15:19:05 UTC
Last Seen2026-06-28 19:41:57 UTC
Profile Built2026-06-29 01:43:47 UTC
Data FreshnessLive
Signal Types20
Total Observations23
🔍 20 signal types · 23 observations collected
This report is generated from 20+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.
{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.