198.244.226.217📋 Copy

# IP Intelligence Briefing: 198.244.226.217/32

Date: 2026-06-28

Risk Classification: Moderate Risk (Score: 40/100)

Status: Active Observation

---

## Executive Summary

IP 198.244.226.217 is a cloud-hosted infrastructure address operated by OVH (ASN 16276) under the organization "Ahrefs Pte Ltd Dmytro." The IP is geolocated to London, England with a 750km accuracy radius. While the address itself shows no direct threat indicators, it operates within a high-abuse density subnet (0.6758) with 173 out of 204 active sibling IPs classified as threats. The IP is associated with the ahrefs.net domain via DNS PTR record proxy-uk002-san217.ahrefs.net.

---

## Technical Profile

Ownership & Provider:

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• RIR: ARIN
• CIDR Block: 198.244.128.0/17 (BGP Prefix)
• Registration: Cloud infrastructure deployment

Geolocation:

• Country: GB (England)
• Coordinates: 55.38°N, -3.44°W
• Timezone: Europe/London
• RTT: Average 94.8ms (minimum 89ms)
• GeoValidation: Plausible with 5 probes

Network Role:

• Classification: Hosting Provider
• Infrastructure: CloudCompute
• Connection Type: Firewalled / No Services
• Services: No open ports detected
• TLS Certificates: None

DNS Analysis:

• PTR Hostname: proxy-uk002-san217.ahrefs.net
• Forward Resolution: Confirmed to ahrefs.net domain
• SPF/DMARC: Not configured

---

## Threat Assessment

Direct Indicators:

• Blacklist Count: 0
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Proxy/VPN: False
• Known Campaigns: None

Network Context Risk:

• Subnet Abuse Density: 0.6758 (High Abuse Classification)
• Inherited Risk Score: 27/100
• Subnet: 198.244.226.0/24
• Total Siblings: 256
• Active Siblings: 204
• Threat Siblings: 173
• Risk Distribution: 0 High, 68 Medium, 32 Low

Control Plane:

• Route Stability: False
• DNSSEC Valid: True
• DNSBL Listed: 1 of 8 total lists
• Operator Score: 0.2174 (Minimal)

---

## Historical Analysis

Observation Count: 22 signals tracked

Key Historical Signals:

• 2026-06-28: Cloud infrastructure classification (OVH provider), confidence 0.90
• 2026-06-20: High abuse subnet classification (0.6758 density), confidence 0.75
• 2026-06-20: Geographic inference to GB with 0.28 confidence
• 2026-06-20: OVH hosting classification confirmed

Temporal Trends:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 1
• Persistently Malicious: False

---

## Relationship Graph

Total Relationships: 41

Primary Network Association: OVH_282347338 (multiple relationships)

The IP shows extensive relationships within the OVH network infrastructure, indicating this is part of a larger hosting deployment.

---

## Recommended Security Actions

Risk-Based Recommendations:

---

## SOC Analyst Assessment

Threat Level: Moderate / Context-Dependent

Key Considerations:

1. Dual Nature: The IP is associated with a legitimate organization (Ahrefs) but operates in a high-abuse density subnet

2. Infrastructure Risk: The subnet shows 68% medium-risk IPs and significant threat activity among siblings

3. No Direct Malicious Activity: No threat indicators, campaigns, or blacklist associations found on this specific IP

4. Blocking Recommendation: Firewall rules recommended due to inherited subnet risk, but contextual investigation advised before blocking legitimate business traffic

Action Priority: Medium

• Block if traffic is unexpected or matches threat patterns
• Allow if traffic matches known ahrefs.net services
• Monitor for behavioral anomalies consistent with subnet abuse patterns

Further Investigation Recommended:

• Compare against known ahrefs.net IP ranges
• Monitor for port scanning or lateral movement attempts
• Review inbound connection patterns against baseline

---

*Report generated from IPDebrief Intelligence Platform. All data points verified through real-time lookup.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.