198.244.226.17📋 Copy

# IP INTELLIGENCE BRIEFING: 198.244.226.17/32

Date: June 27, 2026

Classification: Low Risk

Risk Score: 25/100

Assigned Analyst: SOC Operations

---

## EXECUTIVE SUMMARY

IP address 198.244.226.17 is a low-risk infrastructure endpoint associated with OVH cloud hosting in London, United Kingdom. The IP resolves to an Ahrefs-owned proxy hostname and demonstrates no active threat indicators. While the broader subnet exhibits mixed classification with moderate abuse density, this specific IP shows no persistent malicious behavior.

---

## TECHNICAL PROFILE

Ownership & Registration:

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: London, England, GB
• Network Role: Cloud Compute Infrastructure

DNS Configuration:

• PTR Hostname: proxy-uk002-san17.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed (1 hostname)
• Email Auth: No SPF/DMARC records configured

Control Plane Status:

• BGP Prefix: 198.244.128.0/17
• Route Stability: Unstable
• DNSBL Listings: 1 of 8 total lists (minimal operator score: 0.2174)
• RPKI State: Not evaluated
• DNSSEC: Valid

---

## THREAT ASSESSMENT

Current Risk Indicators:

• Abuse Confidence Score: Not applicable
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Active Threat Feeds: None detected

Network Classification:

• Infrastructure Type: Cloud Compute
• Hosting Provider: Yes
• CDN/VPN/Proxy: No
• Mobile/Residential: No
• Anycast: No

---

## OBSERVATION HISTORY (22 RECORDS)

Temporal Analysis:

• Latest Signal: June 27, 2026 (20:21 UTC)
• Observation Period: June 26-27, 2026
• Threat Persistence: No persistent malicious activity detected
• Ownership Changes: 0 recorded

Signal Trends:

1. Operator Score: 0.087 (minimal)

2. Geolocation Inference: GB (55.38°N, -3.44°W) at 750km accuracy radius

3. Network Classification: Consistently identified as OVH hosting infrastructure

4. Subnet Abuse Density: 0.4102 (mixed classification)

---

## NEIGHBORHOOD ANALYSIS (198.244.226.0/24)

Subnet Risk Profile:

• Total Siblings: 256
• Active Siblings: 216
• Threat Siblings: 105 (41% of active siblings)
• Abuse Density: 0.4102 (moderate)
• Classification: Mixed

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 77
• Low Risk: 23

Notable Neighbors:

• 198.244.226.0: Risk Score 50 (Authority: 50)
• 198.244.226.1-5: Risk Scores 40-50

Analysis: The subnet exhibits elevated risk concentration from neighboring IPs, but target IP 198.244.226.17 maintains low risk classification (score 25). Contextual monitoring recommended for subnet-level correlation.

---

## RELATIONSHIP GRAPH

Identified Connections: 51 records

• Primary Association: OVH Network (OVH_282347338)
• Relationship Type: Same Network (46+ instances)

No additional: Hostnames, organizations, certificates, or correlated IPs detected beyond network-level associations.

---

## RECOMMENDED ACTIONS

Firewall/Network Controls:

• No immediate blocking actions recommended
• Monitor for behavioral changes within the /24 subnet
• Log all connections for baseline analysis

SOC Guidance:

• Monitor: Subnet 198.244.226.0/24 for anomalous traffic patterns
• Correlate: Investigate if traffic from this IP correlates with known Ahrefs infrastructure
• Action Threshold: Escalate if risk score increases above 60 or threat indicators appear

Classification Flags:

• No actionable intelligence requires immediate response
• IP remains within acceptable operational parameters for defensive monitoring

---

## CONCLUSION

IP 198.244.226.17 represents legitimate cloud infrastructure associated with Ahrefs services. While the surrounding subnet shows mixed risk characteristics with 41% of active neighbors flagged as threats, this specific endpoint demonstrates low-risk behavior with no active threat indicators. Continue standard network monitoring protocols and maintain awareness of subnet-level activity patterns.

Status: Monitor

Next Review: 30 days or upon risk score change

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.