198.244.183.6📋 Copy

## IP Intelligence Briefing: 198.244.183.6

Classification: Moderate Risk | Risk Score: 50/100 | Last Updated: 2026-06-28

Ownership & Infrastructure

• ASN: 16276 (Ahrefs Pte Ltd Dmytro)
• Provider: OVH
• Geolocation: London, England, GB
• Registered Organization: Ahrefs Pte Ltd Dmytro
• DNS Resolution: proxy-uk004-san6.ahrefs.net (ahrefs.net)
• Network Classification: Hosting infrastructure, firewalled/no services exposed
• BGP Prefix: 198.244.128.0/17
• Route Stability: Unstable (isRouteStable: false)

Threat Indicators

• Blacklist Status: Listed on 2 of 8 DNSBLs
• Threat Indicators: None directly attributed
• Tor/VPN/Proxy: Not detected (isTor: false, isProxy: false, isVpn: false)
• Campaign Correlation: No known campaign matches

Neighborhood Analysis (198.244.183.0/24)

• Abuse Density: 0.7773 (High Abuse Classification)
• Subnet Population: 256 total IPs, 200 active
• Threat Correlation: 199 of 200 active siblings flagged as threats
• Risk Distribution: Medium risk: 68%, Low risk: 32%, High risk: 0%

Historical Signals

• Observation Count: 22 historical signals
• Recent Activity: Signals observed through 2026-06-28
• Subnet Risk History: Classified as "high_abuse" with 0.7773 abuse density (2026-06-20)
• Provider Consistency: OVH hosting confirmed across observations
• Threat Persistence: No persistent malicious behavior detected

Relationship Graph

• Network Associations: 44 relationships identified, primarily same-network (OVH_282347340)
• Infrastructure: Associated with OVH hosting infrastructure

Recommended Security Actions

Immediate Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 198.244.183.6 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.183.6 drop

# pfSense

198.244.183.6/32 (Block rule)

```

WAF Integration:

• Cloudflare WAF: Block IP with expression: `ip.src eq 198.244.183.6`
• AWS WAF: Add to blocklist: `198.244.183.6/32`

Analyst Assessment

This IP exhibits moderate risk characteristics typical of hosting infrastructure within a high-abuse subnet. The 198.244.183.0/24 subnet demonstrates concentrated threat activity with 199 of 200 active neighbors flagged. While the target IP shows no direct threat indicators, its neighborhood context and DNSBL listings warrant blocking. The IP resolves to an Ahrefs-related hostname but is classified as hosting infrastructure with no open services, suggesting potential misuse or compromised infrastructure.

Recommended Action: Block at perimeter firewall and WAF layers. Monitor subnet 198.244.183.0/24 for additional threat correlation. Investigate associated domains for potential abuse patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.