198.244.183.148📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 198.244.183.148/32

Classification: Moderate Risk / Cloud Infrastructure / Hosting

Date: 2026-06-28

Analyst: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

IP 198.244.183.148 is a cloud hosting endpoint operated by OVH in London, UK. The address resolves to Ahrefs infrastructure (proxy-uk004-san148.ahrefs.net). While the IP itself shows no active threat indicators, the /24 subnet exhibits elevated abuse density (75%), suggesting potential collateral risk from neighboring addresses. The IP was recently listed on 8 threat intelligence feeds with high-severity classifications during June 2026.

---

## INFRASTRUCTURE PROFILE

---

## THREAT ASSESSMENT

Current Threat Indicators: None detected

Blacklist Status: Listed on 8 threat feeds (1 high-severity listing as of June 28, 2026)

Abuse Classification: Minimal operator risk (0.2174)

Campaign Association: No known campaign matches

Key Observations:

• No Tor exit node, proxy, or VPN indicators
• No residential or mobile network classification
• DNSSEC valid with CAA records present
• Not a bogon or anycast address

---

## NEIGHBORHOOD ANALYSIS

Subnet: 198.244.183.0/24

Abuse Density: 75% (High)

Total Siblings: 256

Active Siblings: 176

Threat Siblings: 192

Risk Distribution in /24:

• High Risk: 0
• Medium Risk: 22
• Low Risk: 78

The /24 subnet shows elevated abuse activity despite this IP's moderate risk score. Neighboring IPs include multiple medium-risk endpoints (e.g., 198.244.183.1, 198.244.183.4). This contextual abuse density warrants enhanced monitoring of related addresses.

---

## OBSERVATION HISTORY

Total observations: 22

Recent Activity:

• June 28, 2026: Listed on 8 threat feeds (high severity)
• June 20, 2026: Provider classification confirmed (OVH, hosting infrastructure)
• June 20, 2026: Operator risk score 0.2174 (minimal)

Temporal Analysis: No persistent malicious behavior detected. Ownership and threat persistence days remain at zero.

---

## RECOMMENDED ACTIONS

Based on the moderate risk profile and neighborhood abuse density, consider the following:

Immediate Mitigation

```bash

# iptables

iptables -A INPUT -s 198.244.183.148 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.183.148 drop

```

WAF/Cloud Protection

• Cloudflare WAF: Block with filter `ip.src eq 198.244.183.148`
• AWS WAF: Add 198.244.183.148/32 to blocked addresses
• pfsense: Add 198.244.183.148/32 to block list

Monitoring Recommendations

1. Monitor /24 subnet (198.244.183.0/24) for elevated scan activity

2. Track associated domains (ahrefs.net) for DNS anomalies

3. Review related IPs for potential lateral movement indicators

---

## CONCLUSION

IP 198.244.183.148 is a legitimate cloud hosting endpoint with moderate risk. While no active attack vectors were identified, the high-abuse neighborhood context suggests the IP may be used in coordinated campaigns. Recommend implementing blocking rules per firewall capabilities and maintaining enhanced monitoring of the /24 subnet. The infrastructure appears properly configured with valid DNSSEC and CAA records.

---

*Report generated from IPDebrief intelligence platform. All data sourced from live reconnaissance and historical signal analysis.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.