198.244.183.249📋 Copy

# IP INTELLIGENCE BRIEFING: 198.244.183.249

Classification: Moderate Risk | Last Updated: 2026-06-28

Prepared for: SOC Operations

---

## EXECUTIVE SUMMARY

IP 198.244.183.249 is a cloud hosting address in the London, GB data center operated by OVH (ASN 16276) for Ahrefs Pte Ltd. The IP presents a moderate risk score (40) with no active threat indicators but resides in a high-abuse density subnet (0.7969). The address is associated with legitimate DNS infrastructure (ahrefs.net) but shows minimal service exposure.

---

## NETWORK OWNERSHIP & GEOLOCATION

The IP is associated with the legitimate SaaS provider Ahrefs, operating within OVH's UK data center infrastructure.

---

## THREAT INDICATORS

Risk Assessment: Moderate (Score: 40)

Threat Indicators: None detected

Blacklist Status: Listed on 1 of 8 DNSBL sources

Campaign Association: No known campaign matches

Network Classification:

• Cloud Infrastructure: Yes
• Hosting Service: Yes
• CDN/VPN/Proxy/Tor: No
• Residential: No

---

## SUBNET ANALYSIS: 198.244.183.0/24

The /24 subnet exhibits elevated abuse density with 80% of active IPs flagged as threats. This contextual factor elevates the risk posture of the target IP despite its clean individual profile.

---

## OBSERVATION HISTORY (22 Signals)

Recent Signal Timeline:

• 2026-06-28 18:27: Operator score 0.087 (Minimal), overall confidence 0.30
• 2026-06-20 16:25: Subnet abuse density 0.7969, classification high_abuse
• 2026-06-20 16:23: Network classification: OVH hosting infrastructure
• 2026-06-20 16:18: Operator score 0.2174 (Minimal)

Temporal Assessment: No persistent malicious behavior detected. The IP shows stable ownership with minimal threat persistence.

---

## DNS & SERVICES

The IP resolves to a proxy hostname within Ahrefs' UK infrastructure but shows no active service exposure.

---

## RELATIONSHIP GRAPH

• Network Associations: OVH_282347340 (multiple entries)
• DNS Associations: proxy-uk004-san249.ahrefs.net (multiple entries)
• Organization/Certificate: None detected beyond primary association

---

## CONTROL PLANE & ROUTING

---

## RECOMMENDED ACTIONS

Based on risk profile and subnet context, the following firewall rules are recommended:

Note: These recommendations are probabilistic. Consider combining with additional threat intelligence signals before implementing blocking measures.

---

## ANALYST NOTES

1. Contextual Risk: While the IP itself shows minimal individual threat indicators, its residence in a high-abuse subnet (0.7969 density) warrants heightened scrutiny.

2. Legitimate Infrastructure: DNS associations indicate legitimate Ahrefs hosting infrastructure. Blocking may impact legitimate business communications.

3. Recommended Approach: Implement allow-listing for known Ahrefs IP ranges where possible, or apply rate-limiting rather than outright blocking to balance security and operational continuity.

4. Monitoring: Track for any changes in service exposure or threat indicators that may warrant more aggressive response.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.