198.244.226.100📋 Copy

# IP Intelligence Briefing: 198.244.226.100/32

Classification: Moderate Risk | Date: 2026-06-28

Status: Active Infrastructure | Provider: OVH (Cloud Hosting)

---

## Executive Summary

IP 198.244.226.100 operates as a cloud-compute infrastructure endpoint associated with Ahrefs Pte Ltd. The IP demonstrates a moderate risk profile (score: 40) with no active threat indicators. The subnet exhibits elevated abuse density (0.6484), but the target IP itself shows no malicious behavior in recent observations.

---

## Network & Infrastructure Profile

The IP resolves to a legitimate Ahrefs proxy endpoint with forward DNS confirmation. No open ports or active services detected; the system remains in a firewalled state.

---

## Risk Assessment

Overall Risk Score: 40 (Moderate)

• Reputation: Moderate Risk
• Abuse Confidence: Not applicable (no active indicators)
• Known Attacker: No
• Spam Source: No
• Tor Exit: No
• Blacklist Count: 0
• DNSBL Listed: 1 of 8 lists

Control Plane:

• Route stable: No
• Route changes (30d): 0
• RPKI State: Unknown
• DNSSEC Valid: Yes

---

## Neighborhood Analysis

The /24 subnet (198.244.226.0/24) demonstrates elevated abuse activity:

• Abuse Density: 0.6484 (High Abuse)
• Subnet Classification: high_abuse
• Inherited Risk: 25
• Total Siblings: 256
• Active Siblings: 199
• Threat Siblings: 166

The subnet shows 67% active siblings (199/294) with 166 classified as threats. This contextual risk should be weighed against the target IP's clean profile.

---

## Threat Indicators

No active threat indicators detected:

• No known campaigns
• No threat feeds matches
• No Pulsedive risk signals
• No known attacker signatures

DNS Reputation: Email authentication (SPF/DMARC) not configured on associated domain.

---

## Observation History

Total Observations: 22

• Most Recent: 2026-06-28 (GB geolocation signals)
• Provider Signals: OVH cloud infrastructure consistently identified
• Geolocation: Inconsistent resolution (London, GB consensus; some signals show Scotland at 55.38°N, -3.44°W)
• Threat Persistence: 0 days (not persistently malicious)

Historical signals indicate stable infrastructure placement with OVH hosting. Geolocation inconsistencies warrant monitoring but do not indicate active compromise.

---

## Relationships

• Network: OVH_282347338 (Multiple entries)
• DNS Hostnames: proxy-uk002-san100.ahrefs.net (15 associations)
• Associated Domain: ahrefs.net

The IP maintains a single network relationship with OVH cloud infrastructure and consistent DNS associations to the Ahrefs proxy hostname.

---

## Recommendations

Immediate Actions

1. Allow Traffic: IP shows no active threat indicators; traffic from this endpoint is legitimate Ahrefs infrastructure.

2. Monitor Subnet: Track abuse trends in 198.244.226.0/24 due to elevated neighborhood risk (0.6484 abuse density).

3. Verify Context: Validate any blocked traffic against this IP's legitimate proxy role.

Firewall Rules

• Default: Allow inbound/outbound traffic
• Logging: Enable audit logs for traffic analysis
• Rate Limiting: Consider thresholding if high-volume requests originate from this subnet

Monitoring Triggers

• Alert on new DNS resolutions from this IP
• Monitor for service port openings
• Track subnet abuse density changes

---

## Conclusion

IP 198.244.226.100 represents legitimate cloud-hosted infrastructure for Ahrefs. While the /24 subnet exhibits elevated abuse activity, this specific IP demonstrates no malicious behavior. SOC analysts should treat traffic from this endpoint as benign while maintaining awareness of contextual subnet risks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.