198.244.226.132📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 198.244.226.132/32

Date: 2026-06-26

Classification: Moderate Risk

Source: IPDebrief Intelligence Platform

---

## EXECUTIVE SUMMARY

IP 198.244.226.132 is classified as a moderate-risk address (Risk Score: 40/100) operating within OVH's cloud hosting infrastructure in London, GB. The IP resolves to aresolves to a legitimate Ahrefs domain (proxy-uk002-san132.ahrefs.net) but operates within a /24 subnet exhibiting high abuse density (0.6484). No active threat indicators were detected in the current observation window.

---

## OWNERSHIP & GEOLOCATION

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276
• Provider: OVH
• Location: London, England, GB
• Geolocation Confidence: 750km radius (consensus validated across 1 source)
• Infrastructure Type: CloudCompute / Hosting

---

## NETWORK PROFILE

• DNS PTR: proxy-uk002-san132.ahrefs.net
• Forward Resolution: Confirmed to ahrefs.net domain
• Network Classification: Cloud-hosted infrastructure with firewall configuration
• Open Ports: None detected
• TLS/HTTP Services: No active TLS certificates or HTTP banners observed
• Route Stability: False (routing changes detected)

---

## THREAT ASSESSMENT

• Risk Score: 40 (Moderate)
• Abuse Confidence Score: Not available
• Known Attacker Status: Negative
• Spam Source Status: Negative
• Tor Exit Node: Negative
• DNSBL Listings: 1 of 8 total lists
• Known Campaigns: None correlated
• Blacklist Count: 0

---

## NEIGHBORHOOD ANALYSIS

The /24 subnet (198.244.226.0/24) demonstrates elevated risk characteristics:

• Abuse Density: 0.6484 (High)
• Active Siblings: 202 of 256 total IPs
• Threat Siblings: 166 IPs flagged as threats
• Risk Distribution: 92 medium-risk, 8 low-risk neighbors
• Inherited Risk: 25 points

This indicates the subnet is part of OVH's broader hosting environment with concentrated threat activity across sibling addresses.

---

## OBSERVATION HISTORY

24 historical observations recorded through 2026-06-26:

• Latest Signal (2026-06-26): Geolocation inference (GB), Network classification (hosting)
• Previous Signal (2026-06-19): High-abuse density classification for subnet
• Persistence: Single threat observation window; not persistently malicious
• Temporal Trend: No sustained malicious behavior pattern detected

---

## RELATIONSHIP MAPPING

53 relationships identified:

• Network Associations: Multiple "Same Network" relationships to OVH_282347338
• Campaign Correlations: None detected
• Certificate Matches: None
• Banner Matches: None

---

## RECOMMENDED ACTIONS

No specific firewall or blocking rules generated based on current risk profile. The IP represents legitimate hosting infrastructure with no active threat indicators. SOC teams may:

• Monitor for changes in DNS resolution patterns
• Track subnet-level abuse density trends
• Correlate with known Ahrefs infrastructure for context

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.