198.244.183.78📋 Copy

## Intelligence Briefing: 198.244.183.78

Classification: Moderate Risk | Date: 2026-06-28

---

**EXECUTIVE SUMMARY**

IP address 198.244.183.78 is a cloud-hosted infrastructure endpoint (OVH) operating from London, GB, with a moderate risk score of 40. The IP resolves to an Ahrefs service hostname and shows no active threat indicators, though it resides in a high-abuse density subnet (0.7812) containing 200 threat siblings.

---

**NETWORK CONTEXT**

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: London, England, GB (750km accuracy radius)
• Infrastructure: CloudCompute hosting environment
• DNS Resolution: proxy-uk004-san78.ahrefs.net
• BGP Prefix: 198.244.128.0/17 (route stability: false)

---

**RISK ASSESSMENT**

• Overall Risk Score: 40 (Moderate)
• Provider Score: 0 (No provider reputation issues)
• Authority Score: 0 (No authority reputation issues)
• DNSBL Listed: 1 of 8 total lists
• Threat Indicators: None detected (no blacklist hits, not known attacker, not spam source, not Tor/VPN/proxy)
• Open Ports: None detected (firewalled/no services)
• Campaign Activity: None observed

---

**SUBNET ANALYSIS (198.244.183.0/24)**

• Abuse Density: 0.7812 (High Abuse Classification)
• Total Subnet Siblings: 256
• Active Siblings: 211
• Threat Siblings: 200
• Risk Distribution: 0 High | 51 Medium | 49 Low
• Inherited Risk Score: 31

Note: While this specific IP shows no active threats, the high-abuse subnet environment warrants contextual awareness.

---

**OBSERVATION HISTORY**

21 observations recorded over recent period. Key signals include:

• Cloud hosting infrastructure (OVH) consistently identified
• Geographic inference pointing to GB (London region)
• Abuse density classification maintained as "high_abuse"
• No ownership changes detected
• Zero threat persistence days observed
• No campaign correlations

---

**RECOMMENDED ACTIONS**

Monitoring:

• Monitor for service port openings (currently firewalled)
• Track subnet abuse density changes
• Review DNSBL listing status (1 of 8 lists)

Firewall/Security:

• No immediate blocking required (low risk, no active threats)
• Consider rate-limiting if this IP initiates connections
• Monitor for changes in DNS resolution or hostname patterns

Investigation Triggers:

• If this IP begins exhibiting threat behavior
• If subnet abuse density increases further
• If new DNSBL listings emerge

---

Analyst Notes: This IP represents legitimate cloud hosting infrastructure with no current malicious indicators. The moderate risk score primarily reflects the high-abuse environment of its /24 subnet rather than specific malicious activity from this endpoint. Treat as low-priority for monitoring unless behavioral changes occur.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.