198.244.183.187📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 198.244.183.187/32

Classification: Moderate Risk Infrastructure Node

Date: 2026-06-20

Prepared For: SOC Analyst

---

## EXECUTIVE SUMMARY

IP address 198.244.183.187 is a moderate-risk (50/100) cloud hosting infrastructure node operated by OVH (ASN 16276) within the Ahrefs Pte Ltd Dmytro organization. Located in London, GB, this IP resolves to proxy-uk004-san187.ahrefs.net and is currently firewalled with no active services detected. While the IP itself shows no active threat indicators, its immediate /24 neighborhood exhibits significantly elevated abuse density (0.7773), with 199 of 200 active siblings flagged as threat sources.

---

## TECHNICAL PROFILE

Ownership & Infrastructure:

• Provider: OVH (ASN 16276)
• Classification: CloudCompute, Hosting
• CIDR: 198.244.183.187/24
• Registration: ARIN

Geolocation:

• Country: Great Britain (GB)
• Region: England
• City: London
• Accuracy: 750km (multi-source consensus)

DNS & Services:

• PTR: proxy-uk004-san187.ahrefs.net
• Forward Resolution: proxy-uk004-san187.ahrefs.net
• Open Ports: None detected
• Service Status: Firewalled / No Services
• TLS Certificate: None

---

## THREAT ASSESSMENT

Current Risk Score: 50 (Moderate)

DNSBL Status: Listed on 2 of 8 threat feeds

Campaign Correlation: None identified

Known Threat Indicators: None active

Behavioral Indicators:

• Not a Tor exit node
• Not a known attacker
• Not a spam source
• Not classified as proxy/VPN/residential

---

## NEIGHBORHOOD ANALYSIS

Subnet: 198.244.183.0/24

Abuse Density: 0.7773 (High Abuse Classification)

Active Siblings: 200 of 256 total IPs

Threat Siblings: 199 of 200 active

Risk Distribution in /24:

• High Risk: 0 IPs
• Medium Risk: 68 IPs
• Low Risk: 32 IPs

Key Observation: The subnet demonstrates high threat concentration. 198.244.183.187 shares network infrastructure with 199 flagged threat IPs, though the target IP itself shows no current malicious activity. This suggests potential platform-level risk rather than individual IP compromise.

---

## OBSERVATION HISTORY

Signal history indicates consistent infrastructure classification:

• 2026-06-20 04:09: Cloud/hosting classification confirmed (OVH provider)
• 2026-06-20 04:06: DNS resolution to ahrefs.net domain with CAA records
• 2026-06-20 04:02: Operator score 0.2174 (Minimal operator risk)
• 2026-06-20 04:02: Geolocation inference GB with 0.28 confidence

No persistent malicious activity observed. 14 total observations across threat, routing, services, ownership, reputation, and geolocation dimensions.

---

## NETWORK RELATIONSHIPS

Same Network Associations:

• Multiple relationships to OVH_282347340 network identifier
• Infrastructure shared within OVH cloud compute environment

Correlated Entities:

• No certificate matches
• No banner matches
• No correlated IPs in known campaigns

---

## RECOMMENDED ACTIONS

Risk-Based Recommendations:

The IP's moderate risk score (50) and lack of active threat indicators suggest limited immediate threat. However, the high-abuse-density neighborhood warrants defensive posture.

Recommended Firewall Rules:

---

## ANALYST NOTES

1. Contextual Risk: While this IP shows no active malicious behavior, its neighborhood (198.244.183.0/24) exhibits high abuse density. Consider blocking the entire /24 if traffic patterns warrant.

2. Infrastructure Type: As a hosted proxy node (ahrefs.net), this IP may be legitimately used for web scraping, SEO tools, or legitimate marketing infrastructure.

3. DNSBL Consideration: The IP is listed on 2 DNSBL feeds. Investigate specific blacklist reasons if blocking impacts business operations.

4. Monitoring: Continue monitoring for any changes in threat indicators, especially given the high-threat sibling count in the subnet.

5. Action Threshold: At risk score 50, this IP falls into the moderate category. Apply blocking rules selectively based on organizational tolerance for false positives versus security posture.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.