198.244.226.133📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 198.244.226.133/32

Classification: Moderate Risk | Date: 2026-06-20

## EXECUTIVE SUMMARY

The target IP 198.244.226.133 is a cloud-compute infrastructure address registered to OVH (ASN 16276) with geolocation in London, England. While the IP itself shows no direct threat indicators, it operates within a high-abuse-density subnet (198.244.226.0/24) exhibiting significant neighborhood risk. The IP resolves to Ahrefs.net infrastructure but presents no active services, with all ports firewalled.

## THREAT PROFILE

## NEIGHBORHOOD ANALYSIS

The /24 subnet (198.244.226.0/24) shows concerning abuse patterns:

• Abuse Density: 0.6758 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 204
• Threat Siblings: 173 (67% of active IPs)
• Inherited Risk Score: 27

This subnet demonstrates a high concentration of potentially malicious activity, with the target IP inheriting neighborhood-based risk exposure.

## OBSERVATION HISTORY

Recent monitoring (2026-06-20) reveals:

• Consistent subnet classification as "high_abuse"
• Campaign likelihood: None
• No correlated IPs or certificate matches
• BGP prefix stability: Stable (198.244.128.0/17)
• Route changes (30d): 0

No escalation in threat signals observed in the observation window.

## INFRASTRUCTURE CONTEXT

• DNS Resolution: proxy-uk002-san133.ahrefs.net → ahrefs.net
• Email Auth: SPF/DMARC records not configured
• TLS Certificates: None detected
• Network Classification: Cloud provider infrastructure (OVH)
• 44 Relationships: Primarily same-network (OVH_282347338) associations

## RECOMMENDED ACTIONS

SOC Analyst Guidance: Monitor with elevated caution due to high-abuse neighborhood context. No immediate blocking required based on direct threat indicators.

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 198.244.226.133 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.226.133 drop

# Cloudflare WAF

{

"description": "Block 198.244.226.133 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 198.244.226.133"

}

}

```

Recommended Classification:

• Block: Yes (due to neighborhood risk)
• Monitor: Yes (if not blocked)
• Alert Threshold: Medium

## INTELLIGENCE NOTES

The IP resolves to Ahrefs.net infrastructure, suggesting potential legitimate use case. However, the subnet's high abuse density (67% threat siblings) warrants defensive blocking. The lack of active services and firewalled status indicates this may be a dormant or backend infrastructure endpoint. Recommend blocking at perimeter firewall and monitoring for any service activation or behavioral anomalies.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.