198.244.226.244📋 Copy

# IP Intelligence Briefing: 198.244.226.244

## Executive Summary

IP address 198.244.226.244 presents a Moderate Risk profile (risk score: 40) within a high-abuse-density subnet (abuse density: 0.6133). The IP is hosted by OVH in the London region, UK, and is associated with Ahrefs Pte Ltd Dmytro. While no active threat indicators were identified, the IP resides in a subnet with 157 confirmed threat siblings, warranting defensive monitoring.

## Network Classification

• Provider: OVH (ASN: 16276)
• Infrastructure Type: Cloud Compute / Hosting
• Geolocation: GB (England, London) — inferred with 28% confidence
• BGP Prefix: 198.244.128.0/17
• Subnet: 198.244.226.0/24 (high_abuse classification)

## Risk Assessment

The IP shows no direct threat indicators: not classified as a known attacker, spam source, Tor exit node, or VPN/proxy. However, the subnet-level abuse density (0.6133) and 157 threat siblings indicate elevated neighborhood risk.

## DNS & Services

• PTR Hostname: proxy-uk002-san244.ahrefs.net
• Forward Resolved Domain: ahrefs.net
• Open Ports: None detected
• Services: No open services (firewalled/no services detected)
• TLS Certificate: None
• HTTP Services: None

## Historical Signals (25 Observations)

Recent observations (as of 2026-06-14) indicate:

• Consistent cloud hosting classification (OVH)
• Abuse density signals persisting at 0.6133
• Geographic inference consistently pointing to GB region
• No changes in infrastructure type or provider

## Related Entities

• Network: OVH_282347338 (198.244.128.0/17)
• Related IPs: 57 network relationships identified
• Subnet Risk: 166 active siblings, 157 threat siblings in /24

## Recommended Actions

Based on the moderate risk profile and high-abuse neighborhood context, the following firewall rules are recommended:

```bash

# iptables

iptables -A INPUT -s 198.244.226.244 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.226.244 drop

# nginx

deny 198.244.226.244;

# pfSense

198.244.226.244/32

# Cloudflare WAF

action: block

expression: ip.src eq 198.244.226.244

# AWS WAF

Addresses: 198.244.226.244/32

Description: IPDebrief risk 40

```

## Intelligence Conclusion

This IP warrants monitoring with defensive blocking due to its location in a high-abuse-density subnet. While the individual IP shows no direct malicious indicators, the subnet context (157 threat siblings) suggests potential lateral risk. Consider blocking at the perimeter with continued monitoring for any behavioral changes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.