198.244.183.151📋 Copy

# IP INTELLIGENCE BRIEFING: 198.244.183.151/32

Classification: Moderate Risk | Provider: OVH (ASN 16276) | Location: London, England, GB

---

## EXECUTIVE SUMMARY

IP address 198.244.183.151 operates as a cloud-based hosting endpoint within OVH's infrastructure. The IP resolves to proxy-uk004-san151.ahrefs.net, indicating association with the Ahrefs web analytics platform. While classified as moderate risk (score: 50), the endpoint shows no active threat indicators, malicious persistence, or known attacker associations. The subnet exhibits elevated abuse density (0.7812), suggesting shared infrastructure usage patterns.

---

## INFRASTRUCTURE PROFILE

---

## THREAT INDICATORS

• Blacklist Status: 0 direct blacklist hits; 2 DNSBL listings out of 8 total checks
• Malicious Activity: No Tor exit, no known attacker attribution, no spam source designation
• Campaign Association: None detected
• Threat Persistence: 0 threat observation days; not persistently malicious

---

## OBSERVATION HISTORY

Analysis of 26 historical observations reveals stable infrastructure characteristics:

• Infrastructure Classification: Consistent cloud hosting designation across all recent observations
• ASN Continuity: ASN 16276 maintained since 2001-02-15 (9,256 days active)
• BGP Routing: Stable path via AS34549 and AS16276
• DNS Resolution: Consistent forward resolution to ahrefs.net domain
• Provider: OVH cloud hosting throughout observation period

No degradation in infrastructure stability or emergence of malicious behavior signals detected.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 198.244.183.0/24

Risk Distribution in /24 Subnet:

• High Risk: 0
• Medium Risk: 44
• Low Risk: 56

The subnet demonstrates high abuse density with 200 of 211 active siblings showing threat indicators. This contextualizes the target IP's moderate risk classification within an environment of elevated neighbor activity.

---

## RELATIONSHIP GRAPH

40 relationships detected, primarily categorized as "Same Network" associations with OVH infrastructure identifier OVH_282347340. No cross-organizational or certificate-based relationships observed.

---

## RECOMMENDED ACTIONS

Risk-Based Recommendation: Monitor | Blocking Status: Optional

While the IP carries a moderate risk score, no active threat indicators warrant immediate blocking. However, given the high-abuse-density subnet context, organizations may consider defensive posture adjustments.

Suggested Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 198.244.183.151 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.183.151 drop

# nginx

deny 198.244.183.151;

# pfSense

198.244.183.151/32

# Cloudflare WAF

{

"description": "Block 198.244.183.151 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 198.244.183.151"

}

}

# AWS WAF

{

"Addresses": ["198.244.183.151/32"],

"Description": "IPDebrief risk 50"

}

```

---

## ANALYST NOTES

This endpoint operates within legitimate cloud hosting infrastructure associated with Ahrefs web services. The moderate risk score reflects subnet-level noise rather than endpoint-specific malicious activity. Security teams should evaluate blocking decisions based on organizational threat tolerance and observed traffic patterns. The high abuse density in the /24 subnet warrants monitoring of adjacent IP addresses for coordinated activity patterns.

Confidence Level: High — 26 historical observations, stable infrastructure, verified geolocation consensus

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.