198.244.226.250📋 Copy

## IP INTELLIGENCE BRIEFING: 198.244.226.250

Classification: MODERATE RISK / HIGH-ABUSE SUBNET

Date Generated: 2026-06-20

Analysis ID: IP-198.244.226.250-20260620

EXECUTIVE SUMMARY

IP 198.244.226.250 is a cloud computing infrastructure address operated by OVH (ASN 16276) for organization Ahrefs Pte Ltd Dmytro. The IP is located in London, England and is associated with a high-abuse density subnet (198.244.226.0/24) with 64.84% abuse classification. Risk score is moderate (40/100) with no active threat indicators, but contextual risk is elevated due to neighborhood context and routing instability.

OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• RIR: ARIN
• Geolocation: London, England, GB (validated, 473.7km from reference point)
• Infrastructure Type: Cloud Compute (Hosting)
• Network Role: Firewall / No Services (no open ports detected)
• DNS Record: proxy-uk002-san250.ahrefs.net

THREAT INDICATORS

• Risk Score: 40 (Moderate Risk)
• Known Threat Feeds: None
• Known Campaigns: None
• Blacklist Status: 0 blacklist entries
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Status: Listed on 1 of 8 threat feeds

NETWORK CONTEXT & RISK ELEVATORS

• Subnet Abuse Density: 0.6484 (High Abuse Classification)
• Threat Siblings in /24: 166 out of 256 total IPs
• Active Siblings: 199
• Inherited Risk: 25 (from neighborhood context)
• Route Stability: False (routing instability detected)
• Operator Score: 0.2174 (Minimal)
• BGP Prefix: 198.244.128.0/17

OBSERVATION HISTORY

• Total Observations: 23 signals
• Recent Activity: 2026-06-15 to 2026-06-20
• Persistence: Not persistently malicious
• Threat Observation Count: 1
• Geolocation Validation: Plausible (minimum possible RTT: 9.5ms)

NETWORK RELATIONSHIPS

• Same Network Associations: 36 relationships to OVH infrastructure (OVH_282347338)
• Control Plane: Origin ASN 16276, RPKI state undetermined

SECURITY RECOMMENDATIONS

Based on the IP's profile:

• Recommended Action: Monitor / Block based on organizational policy
• Rationale: Moderate risk score combined with high-abuse subnet context warrants defensive monitoring
• Firewall Rule: Consider rate limiting if outbound connections are permitted to this IP
• Geolocation Filter: London, GB (consider if geo-filtering is in use)

ANALYST NOTES

This IP is part of OVH cloud hosting infrastructure for Ahrefs. While the IP itself shows no active threat indicators, it resides in a subnet with 64.84% abuse density. The route instability (isRouteStable: false) and minimal operator score suggest dynamic infrastructure typical of cloud hosting. No immediate threat indicators present, but contextual risk from neighborhood context should inform security policy decisions.

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.