198.244.183.96📋 Copy

## IP Intelligence Briefing: 198.244.183.96/32

Classification: Moderate Risk (40/100)

Date of Analysis: 2026-06-20

---

EXECUTIVE SUMMARY

IP 198.244.183.96 is a cloud-hosted infrastructure address owned by Ahrefs Pte Ltd Dmytro, operating on OVH public cloud infrastructure (AS16276) in London, England. The IP resolves to aresidential proxy hostname (proxy-uk004-san96.ahrefs.net) and exhibits no open services, indicating a properly firewalled endpoint. While the parent subnet demonstrates elevated abuse density, this specific IP shows minimal operator-level risk indicators with limited DNSBL presence (1 of 8 lists).

---

OWNERSHIP & GEOLOCATION

---

THREAT INDICATORS

Operator Score: 0.2174 (Minimal)

---

NETWORK ENVIRONMENT

Subnet: 198.244.183.0/24

• Total Siblings: 256
• Active Siblings: 211
• Threat Siblings: 203
• Abuse Density: 0.793 (High Abuse Classification)
• Inherited Risk Score: 31/100

Risk Distribution in /24:

• High Risk: 0 IPs
• Medium Risk: 35 IPs
• Low Risk: 65 IPs

---

OBSERVATION HISTORY

Total Observations: 19 signals recorded

Recent classification signals indicate consistent cloud-hosting behavior with OVH provider classification. No escalating threat patterns observed. The IP demonstrates stability with no ownership changes or persistent malicious activity markers.

---

INFRASTRUCTURE RELATIONSHIPS

Identified Relationships: 35 total

• Primary Network Affiliation: OVH_282347340
• Relationship Type: Same Network (cloud provider infrastructure)

---

RECOMMENDED ACTIONS

SOC Analyst Guidance:

1. No blocking required — IP belongs to legitimate SEO analytics provider (Ahrefs)

2. Monitor DNS traffic — Proxy hostname indicates potential reverse proxy usage

3. Contextual filtering — Consider allowing based on organizational policy for Ahrefs services

4. Subnet awareness — Parent /24 shows elevated abuse density; monitor for anomalous patterns

5. DNSBL verification — One DNSBL listing warrants periodic review for context

Firewall Rule Consideration:

• Permissive by default
• Log outbound connections to this subnet for baseline traffic analysis
• No immediate threat-based blocking actions indicated

---

RISK ASSESSMENT

Overall Risk Level: MODERATE (40/100)

Risk Factors:

• Elevated subnet abuse density (0.793)
• Single DNSBL listing
• Proxy infrastructure designation

Mitigating Factors:

• Legitimate enterprise ownership (Ahrefs)
• No open services detected
• No active threat campaigns
• Minimal operator score
• No persistent malicious behavior

Threat Intelligence Confidence: HIGH — Data consistency across multiple signals with clear ownership and infrastructure context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.