198.244.183.210📋 Copy

# INTELLIGENCE BRIEFING: 198.244.183.210

Classification: MODERATE RISK | Priority: MEDIUM | Generated: 2026-06-15

## EXECUTIVE SUMMARY

IP address 198.244.183.210 is a cloud infrastructure endpoint associated with OVH hosting in London, UK. While the IP itself shows no direct malicious indicators, it operates within a high-abuse density subnet (0.7383) with 189 threat siblings. The address resolves to legitimate Ahrefs infrastructure with defensive firewall configuration.

## NETWORK IDENTIFICATION

## RISK ASSESSMENT

## SUBNET ANALYSIS (198.244.183.0/24)

• Abuse Density: 0.7383 (HIGH)
• Classification: High Abuse
• Total Subnet Siblings: 256
• Active Siblings: 176
• Threat Siblings: 189
• Risk Distribution: 100 medium-risk IPs, 0 high, 0 low

## OBSERVATION HISTORY

• Total Observations: 17
• Last Observation: 2026-06-15T04:57:49Z (Confidence: 0.75)
• Threat Persistence: 0 days
• Ownership Changes: 0
• Status: Not persistently malicious

Key temporal signals:

1. Subnet abuse density classification: High abuse (0.7383)

2. Operator score: 0.2174 (Minimal)

3. DNS control plane: Route stability issues detected

## RELATIONSHIP MAPPING

Network Relationships:

• Primary network: OVH_282347340 (15 relationship entries)

DNS Associations:

• Hostname: proxy-uk004-san210.ahrefs.net (18 relationship entries)

## INFRASTRUCTURE STATUS

• Open Ports: None detected
• Services: Firewalled / No Services
• TLS Certificate: None
• HTTP Title: None detected

Control Plane Indicators:

• DNSSEC Valid: Yes
• RPKI State: N/A
• IRR Consistency: N/A
• Route Changes (30d): 0
• DNSBL Listed: 1 of 8 checks

## SOC ACTIONABLE INTELLIGENCE

Threat Indicators

None detected. The IP shows no active malicious behavior, Tor exit node activity, spam source classification, or blacklist presence.

Risk Context

• Elevated neighborhood risk: The /24 subnet contains 189 threat siblings, indicating this IP block is part of an infrastructure segment with high abuse activity
• Cloud hosting: OVH infrastructure typically hosts legitimate services including web proxies, CDNs, and corporate endpoints
• Legitimate ownership: Ahrefs (SEO analytics platform) with Dmytro as organizational contact

Recommended Actions

1. Monitor, not block: No immediate blocking recommended. The IP itself shows no malicious indicators

2. Traffic analysis: Monitor outbound connections from this IP for anomalous patterns given the high-abuse subnet context

3. Geolocation validation: Current London, UK placement aligns with OVH UK hosting data

4. DNS verification: Confirmed resolution to ahrefs.net infrastructure

Firewall Rules

No immediate firewall rules recommended. Existing infrastructure security controls should be maintained.

## INTELLIGENCE CONCLUSION

This IP represents legitimate OVH cloud infrastructure hosting Ahrefs services. While the /24 subnet exhibits elevated abuse characteristics (common in shared cloud hosting environments), this specific endpoint shows no malicious indicators. SOC teams should monitor traffic patterns but no blocking action is warranted at this time. The high neighborhood abuse density reflects shared infrastructure risks rather than individual IP compromise.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.