198.244.183.58📋 Copy

# IP Intelligence Briefing: 198.244.183.58

Classification: MODERATE RISK | Date: 2026-06-23 | Analyst: SOC Intelligence

---

## Executive Summary

IP address 198.244.183.58 is a cloud-based infrastructure endpoint associated with Ahrefs Pte Ltd, operated through OVH cloud services in London, England. The IP presents moderate risk (score: 40) with no active threat indicators or known malicious campaigns. However, the /24 subnet exhibits elevated abuse density, suggesting potential lateral threat activity from neighboring addresses.

---

## Technical Profile

Ownership & Infrastructure:

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: London, England, GB (RIR: ARIN)
• Infrastructure Type: CloudCompute (OVH Hosting)
• BGP Prefix: 198.244.128.0/17
• IP Classification: Firewalled / No Services Detected

Network Role:

• Is Cloud: Yes
• Is Hosting: Yes
• Connection Type: Not specified
• DNS Resolvable: Yes (proxy-uk004-san58.ahrefs.net)

---

## Threat Assessment

Current Risk Profile:

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence: Not applicable
• Blacklist Status: 0 blacklists, 1 DNSBL listing
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

Control Plane Analysis:

• Operator Score: 0.2174 (Minimal)
• DNSSEC Valid: Yes
• RPKI State: Unspecified
• Route Stability: False (0 route changes in 30 days)

---

## Neighborhood Analysis (198.244.183.0/24)

Subnet Abuse Metrics:

• Abuse Density: 0.6875 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 212
• Threat Siblings: 176
• Inherited Risk Score: 27

Risk Distribution: 100 medium-risk neighbors detected across the /24 subnet. This indicates a shared infrastructure environment with elevated abuse potential from adjacent IP addresses.

---

## Observation History

Temporal Analysis (25 total observations):

• 2026-06-23: Abuse density 0.6875, inherited risk 27
• 2026-06-19: Abuse density 0.7539, inherited risk 30

Trend: Slight decrease in abuse density and inherited risk over the 4-day observation window. No persistent malicious behavior detected (threat persistence days: 0).

---

## Intelligence Relationships

Network Associations:

• Primary network: OVH_282347340
• Total relationships: 60 entries
• Multiple same-network associations to OVH infrastructure

---

## SOC Recommendations

1. MONITOR, DO NOT BLOCK:

The IP shows no active threat indicators. Blocking is not recommended without correlation to malicious activity.

2. MONITOR NEIGHBORING ADDRESSES:

The /24 subnet exhibits high abuse density with 176 threat-sibling IPs. Consider implementing monitoring rules for the following pattern:

```

subnet: 198.244.183.0/24

alert: High abuse density detected

```

3. DNS VALIDATION:

PTR hostname resolves to proxy-uk004-san58.ahrefs.net. Verify legitimacy against Ahrefs known infrastructure.

4. CONTINUED OBSERVATION:

Maintain observation of the IP for 7-14 days. Monitor for escalation in abuse indicators or campaign correlations.

---

End of Briefing

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.