198.244.183.197📋 Copy

# IP INTELLIGENCE BRIEFING: 198.244.183.197

## Executive Summary

IP 198.244.183.197 is a moderate-risk infrastructure endpoint associated with Ahrefs Pte Ltd Dmytro (AS16276), hosted on OVH cloud infrastructure in London, England. While the IP itself shows no direct threat indicators, it resides within a high-abuse-density subnet (198.244.183.0/24) with 74.22% abuse density and 190 threat siblings out of 256 total addresses. The asset is firewalled with no open services and is DNS-resolved to proxy-uk004-san197.ahrefs.net.

## Technical Profile

Risk Assessment: Moderate Risk (Score: 40)

Infrastructure Type: CloudCompute / Hosting

Provider: OVH (AS16276)

Geolocation: London, England (GB) - 473.7km from claimed coordinates; 91-96ms RTT

DNS Resolution: proxy-uk004-san197.ahrefs.net (ahrefs.net)

Services: None detected (firewalled/no services)

TLS/Certificates: None active

Control Plane Indicators:

• DNSBL Listed: 1 of 8 lists
• Route Stability: False (not route-stable)
• RPKI State: Not reported
• BGP Prefix: 198.244.128.0/17

## Threat Intelligence Observations

Abuse Density: 0.7422 (High Abuse Classification)

Inherited Risk Score: 29-31

Threat Persistence: No persistent malicious activity detected

Campaign Correlation: No campaign matches or correlated IPs identified

Historical Signal Summary (22 observations):

• June 15, 2026: Abuse density 0.7422, 176 active siblings, 190 threat siblings
• June 20, 2026: Abuse density increased to 0.793, 211 active siblings, 203 threat siblings
• Geographic inference shows London coordinates with multi-signal evidence
• ASN AS16276 (OVH SAS) flagged with threat indicators in external feeds

## Network Context Analysis

Subnet Assessment: 198.244.183.0/24

• Classification: High Abuse
• Total Addresses: 256
• Active Siblings: 176
• Threat Siblings: 190
• Neighbor Risk Distribution: 100 medium-risk IPs (score 40), authority score 50

Relationship Graph (27 entries):

• Network associations: Multiple instances mapped to OVH_282347340
• DNS associations: 16 instances resolving to proxy-uk004-san197.ahrefs.net

## Recommended Actions

Firewall/Network Rules:

• Monitor for outbound connections from internal systems to this IP
• Allow traffic only if legitimate Ahrefs service is required
• Consider blocking if not a known business requirement

Detection Rules:

```

# Block if not business-required

iptables -A INPUT -d 198.244.183.197 -j DROP

# Log for monitoring

iptables -A INPUT -d 198.244.183.197 -j LOG --log-prefix "AHREFS-MONITOR: "

```

Contextual Considerations:

• The IP resolves to Ahrefs domain (legitimate SaaS platform for SEO tools)
• No direct threat indicators on the IP itself
• High neighborhood abuse density suggests broader infrastructure risk
• Recommended to whitelist if known business traffic, otherwise block at perimeter

## Confidence Assessment

• Geographic inference: Plausible (geoPlausible: true)
• Ownership attribution: Confirmed (AS16276, Ahrefs infrastructure)
• Threat classification: Moderate (neighborhood-driven risk)
• Activity monitoring: Recommended due to high-abuse subnet context

---

*Report generated from IPDebrief intelligence data. Review periodically for updates.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.