198.244.226.25📋 Copy

# IP INTELLIGENCE BRIEFING: 198.244.226.25

## EXECUTIVE SUMMARY

IP 198.244.226.25 presents as a moderate-risk hosting endpoint (Risk Score: 40) operated by OVH in London, United Kingdom. While the endpoint itself shows no direct threat indicators, the subnet exhibits high abuse density with 61.33% classification. The IP is associated with Ahrefs Pte Ltd Dmytro and operates under ASN 16276 as a cloud hosting infrastructure.

## RISK ASSESSMENT

• Overall Risk Score: 40 (Moderate Risk)
• Provider Risk: 0
• Authority Risk: 0
• Stability Status: Null
• Classification: Moderate Risk
• Threat Indicators: None detected
• Blacklist Status: 0 blacklists (0 DNSBL entries at time of last observation)

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276
• Organization: Ahrefs Pte Ltd Dmytro
• RIR: ARIN
• Provider: OVH
• Infrastructure Type: CloudCompute
• Service Purpose: Firewalled / No Services
• Geolocation: London, England, GB (Accuracy Radius: 750 km)
• CIDR Block: 198.244.128.0/17
• DNS PTR: proxy-uk002-san25.ahrefs.net

## NETWORK BEHAVIOR

• Open Ports: None detected (fully firewalled)
• Active Services: No HTTP/HTTPS services accessible
• TLS Certificate: None
• HTTP Headers: No HSTS, CSP, or security headers detected
• DNSSEC: Valid
• Route Stability: Unstable (isRouteStable: false)
• DNSBL Status: Listed on 1 of 8 monitored lists

## NEIGHBORHOOD ANALYSIS

The /24 subnet (198.244.226.0/24) demonstrates elevated threat characteristics:

• Abuse Density: 0.6133 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 174
• Threat Siblings: 157
• Inherited Risk Score: 24

Network reputation suggests significant shared infrastructure usage with potential for lateral threat propagation.

## OBSERVATION HISTORY

Analysis of 21 historical observations reveals consistent classification patterns:

• Most recent signals: 2026-06-14
• Abuse density classification: Consistently "high_abuse"
• Provider attribution: OVH maintained throughout observation period
• No significant risk escalation detected over observation window

## THREAT CONTEXT

• Campaign Association: None detected
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Known Campaigns: None

## SECURITY RECOMMENDATIONS

Firewall Actions

The following rules are recommended based on risk profile:

iptables:

```

iptables -A INPUT -s 198.244.226.25 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 198.244.226.25 drop

```

NGINX:

```

deny 198.244.226.25;

```

Cloudflare WAF:

```

{

"description": "Block 198.244.226.25 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 198.244.226.25"

}

}

```

AWS WAF:

```

{

"Addresses": ["198.244.226.25/32"],

"Description": "IPDebrief risk 40"

}

```

## INTELLIGENCE NOTES

1. The IP is part of OVH hosting infrastructure with firewalled configuration

2. High neighborhood abuse density warrants subnet-level monitoring

3. No direct threat indicators present; classification driven by infrastructure reputation

4. DNSSEC validation and CAA records indicate legitimate hosting operations

5. 157 threat siblings in same /24 subnet suggest coordinated infrastructure usage

## MONITORING RECOMMENDATIONS

• Track subnet-level activity for lateral threat correlation
• Monitor for DNSBL re-listings (currently 1 of 8 lists)
• Observe route stability changes for infrastructure shifts
• Review for correlation with known campaigns in 198.244.128.0/17 prefix

---

*Report generated: 2026-06-14 | Data source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.