198.244.226.224📋 Copy

IP Intelligence Briefing: 198.244.226.224

*Generated via IPDebrief tools: Profile, History, Relationships, Neighbors*

---

**1. IP Profile**

• Risk Score: 40 (Moderate Risk)
• Ownership:

- ASN: AS16276 (OVH)

- Organization: Ahrefs Pte Ltd (proxy server for Ahrefs.net)

- Geolocation: London, England, UK (latitude 51.5081, longitude -0.1278)

• Network Role:

- CloudCompute infrastructure (OVH provider)

- No open ports, no TLS certificate, no HTTP services detected

• Threat Indicators:

- No direct malicious indicators (no spam, attacks, or blacklists)

- BGP route stability: 0.2174 (Minimal operator risk)

- DNSSEC validated, CAA records present

---

**2. Observation History**

• Recent Activity:

- Detected as a high-abuse subnet (198.244.226.224/24) with abuse density 0.5078 (high risk).

- Subnet contains 130 threat siblings (IPs with malicious activity).

- Geolocation validated (473.7 km from claimed location, 96 ms avg RTT).

• Threat Trends:

- No persistent malicious activity observed (threat persistence days: 0).

- Subnet abuse density increased over 30 days (from 0.45 to 0.5078).

---

**3. Relationships**

• Network Associations:

- Linked to OVH_282347338 network (same ASN, high abuse density).

- DNS Associations:

- Resolves to `proxy-uk002-san224.ahrefs.net` (Ahrefs proxy server).

- No domain hosting or email authentication records (SPF/DKIM/D MARC).

• Control Plane:

- BGP prefix: `198.244.128.0/17` (OVH).

- Route stability: 0.2174 (minimal risk).

---

**4. Neighborhood Analysis**

• Subnet: `198.244.226.224/24` (256 IPs)
• Risk Distribution:

- High risk: 0 IPs

- Medium risk: 85 IPs

- Low risk: 15 IPs

• Notable Neighbors:

- IPs with risk scores ≥40 (e.g., 198.244.226.1, 198.244.226.2)

- Subnet abuse density: 0.5078 (high abuse).

---

**5. Recommendations**

• SOC Action:

- Monitor traffic to this subnet due to high abuse density.

- Block or restrict access to IPs with ≥40 risk scores in the subnet.

- Validate DNS associations with Ahrefs.net to confirm legitimacy.

• Long-Term:

- Investigate OVH network (AS16276) for potential misconfigurations or compromised infrastructure.

- Consider isolating cloud instances if not required for operations.

Note: This IP is associated with a legitimate cloud provider (OVH) and a known proxy service (Ahrefs). However, the subnet’s high abuse density warrants closer scrutiny.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.