198.244.226.192📋 Copy

IP Intelligence Briefing: 198.244.226.192

Date: 2026-06-14

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Provider: OVH (ASN 16276)
• Ownership: Ahrefs Pte Ltd (Dmytro)
• Geolocation: London, England, GB (ARIN-regulated)
• Network Role: CloudCompute Hosting (Firewalled / No Services)
• Threat Indicators: No direct malicious activity detected (no blacklists, spam, or campaigns).

---

**2. Neighborhood Analysis**

• Subnet: 198.244.226.192/24
• Abuse Density: 61.33% (High Abuse Classification)
• Sibling IPs: 256 total, 172 active, 157 flagged as threats.
• Risk Distribution: 85 medium-risk IPs, 15 low-risk IPs.
• Neighbor Examples:

- 198.244.226.0 (Risk: 25/50)

- 198.244.226.1 (Risk: 40/50)

- 198.244.226.2 (Risk: 50/50)

Note: The subnet exhibits high abuse density, suggesting potential lateral movement or shared infrastructure risks.

---

**3. Historical Observations (Last 30 Days)**

• Abuse Density: Stable at 0.61 (high abuse classification).
• Inherited Risk: 24 (likely from subnet-level threats).
• Threat Persistence: No persistent malicious activity detected.
• Network Stability: Route instability (0.2174 "Minimal" operator score).

---

**4. Relationships & Context**

• Network Affiliation: Linked to OVH network (ASN 16276).
• Domain Associations: PTR hostname `proxy-uk002-san192.ahrefs.net` (Ahrefs domain).
• DNS Security: DNSSEC valid, CAA records present, but no email authentication (SPF/DKIM).
• Routing: BGP prefix `198.244.128.0/17`, no RPKI inconsistencies.

---

**5. Recommended Actions**

• Block IP: Implement firewall rules to block traffic from 198.244.226.192.

- iptables: `iptables -A INPUT -s 198.244.226.192 -j DROP`

- Cloudflare WAF: Block IP with risk score 40.

- AWS WAF: Add `198.244.226.192/32` to a custom rule.

• Monitor Subnet: Investigate high abuse density in 198.244.226.0/24.
• Verify Hosting: Confirm Ahrefs' compliance with hosting provider security policies.

---

**6. Summary**

The IP 198.244.226.192 is associated with a legitimate hosting provider (OVH) but resides in a subnet with high abuse density. While no direct threats are detected, the subnet’s risk profile warrants closer monitoring. SOC teams should prioritize blocking this IP and reviewing related subnets for potential lateral movement or shared infrastructure risks.

Next Steps: Correlate with internal logs, validate DNS/hostnames, and assess subnet-level security controls.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.