198.244.226.123📋 Copy

## IP Intelligence Briefing: 198.244.226.123/32

Classification: Moderate Risk | Risk Score: 40 | Report Date: 2026-06-20

---

**Executive Summary**

IP address 198.244.226.123 is a cloud compute infrastructure endpoint operated by Ahrefs Pte Ltd Dmytro within the OVH network. The IP resolves to hostname proxy-uk002-san123.ahrefs.net and is located in London, GB. While no active threat indicators or blacklist entries were detected, the IP resides within a high-abuse density subnet (64.84% abuse rate), indicating elevated neighborhood risk.

---

**Network Ownership & Infrastructure**

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Infrastructure Type: CloudCompute
• Provider: OVH
• Geolocation: London, England, GB (750km accuracy radius)
• DNS Target: proxy-uk002-san123.ahrefs.net (ahrefs.net domain)
• Network Role: Hosting/Cloud with no open services detected

---

**Threat Assessment**

Note: Control plane data indicates 1 DNSBL listing across 8 total lists, though no specific blacklist names were identified.

---

**Subnet Analysis: 198.244.226.123/24**

• Abuse Density: 0.6484 (64.84%)
• Classification: High Abuse
• Total Siblings: 256
• Active Siblings: 199
• Threat Siblings: 166
• Inherited Risk: 25

Risk Distribution: Medium (100), High (0), Low (0)

The subnet exhibits elevated abuse characteristics with 166 threat-sibling IPs among 199 active addresses. This suggests the broader /24 block hosts multiple high-risk entities.

---

**Behavioral & Temporal Indicators**

• Route Stability: Unstable (isRouteStable: false)
• Ownership Changes: 0
• Threat Persistence Days: 0
• Observation Count: 1
• Is Persistently Malicious: No

---

**Historical Observations (Last 24 Signals)**

• 2026-06-20: Abuse density fluctuated between 0.707 (70.7%) and 0.6484 (64.84%)
• Control Plane Score: 0.2174 (Minimal operator risk)
• Geolocation Validation: Plausible with 5 probes, average RTT 88.4ms
• Signal Types: Subnet abuse, control plane, geolocation, network role

---

**Relationship Graph**

• Network Associations: OVH_282347338 (repeated multiple times)
• DNS Associations: proxy-uk002-san123.ahrefs.net (18 instances)

---

**Recommended Actions for SOC Analysts**

1. Monitor Traffic: Implement traffic monitoring for this IP due to high-abuse neighborhood context

2. No Immediate Block: Current profile does not warrant immediate blocking; moderate risk classification

3. Subnet Awareness: Monitor for activity from other IPs in 198.244.226.0/24 block (166 threat siblings)

4. DNS Monitoring: Track DNS queries to proxy-uk002-san123.ahrefs.net for correlation with known malicious activity

5. Cloud Context: Recognize this as legitimate cloud infrastructure (OVH hosting) but maintain vigilance given subnet abuse patterns

---

**Conclusion**

This IP represents legitimate cloud infrastructure hosted by Ahrefs within OVH's London facility. While no direct malicious activity was detected, the high-abuse subnet classification warrants continued monitoring. The 64.84% abuse density in the /24 block suggests potential for collateral threats or coordinated abuse patterns that should be tracked.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.