198.244.226.148📋 Copy

# IP Intelligence Briefing: 198.244.226.148

## Executive Summary

IP address 198.244.226.148 is associated with OVH cloud infrastructure and demonstrates moderate risk characteristics (score: 40). The IP resolves to Ahrefs.net infrastructure and exhibits mixed-to-high abuse patterns within its /24 subnet. Recommended action: Block at perimeter firewall.

## Ownership and Infrastructure

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: England, London, GB
• Infrastructure Type: CloudCompute/Hosting
• DNS Resolution: proxy-uk002-san148.ahrefs.net
• Network Classification: Cloud-hosted infrastructure with no open services detected

## Risk Assessment

• Risk Score: 40/100 (Moderate Risk)
• Abuse Confidence: Low (no blacklist hits; 0/8 DNSBL matches)
• Threat Indicators: None identified (not known attacker, not spam source, not Tor exit node)
• Operator Score: 0.2174 (Minimal)
• Route Stability: False (network routing changes detected)

## Subnet Analysis (198.244.226.0/24)

• Abuse Density: 0.7461 (High Abuse Classification)
• Threat Siblings: 191 of 256 total IPs
• Active Siblings: 214
• Risk Distribution: 25 medium-risk, 75 low-risk neighbors
• Inherited Risk: 29 from subnet analysis

## Historical Observations

Analysis of 24 signal observations indicates temporal volatility:

• 2026-06-20: Abuse density 0.7461, classification "high_abuse", inherited risk 29
• 2026-06-28: Abuse density reduced to 0.3906, classification "mixed", inherited risk 15
• Threat Persistence: Single threat observation recorded

## Recommended Actions

Based on risk profile, the following rules are recommended:

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 198.244.226.148 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.226.148 drop

# nginx

deny 198.244.226.148;

# pfSense

198.244.226.148/32

# Cloudflare WAF

{"description":"Block 198.244.226.148 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 198.244.226.148"}}

# AWS WAF

{"Addresses":["198.244.226.148/32"],"Description":"IPDebrief risk 40"}

```

## Intelligence Notes

The IP appears to be part of Ahrefs proxy infrastructure, but the high-abuse classification of its /24 subnet warrants blocking. The IP shows no active malicious indicators in isolation, but the subnet context and route instability suggest elevated risk. SOC teams should correlate any traffic from this IP with known Ahrefs services to avoid false positives on legitimate traffic.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.