198.244.226.26📋 Copy

# IP Intelligence Briefing: 198.244.226.26/32

Classification: Moderate Risk | Date: Current Analysis | Priority: MEDIUM

## Executive Summary

IP 198.244.226.26 is a cloud infrastructure endpoint belonging to Ahrefs Pte Ltd Dmytro, operated on OVH infrastructure within London, GB. The IP serves as a firewalled proxy endpoint with no active services exposed. While the IP itself demonstrates moderate risk characteristics, its immediate /24 subnet exhibits elevated abuse density, warranting contextual awareness.

## Ownership and Infrastructure

The IP resolves to hostname proxy-uk002-san26.ahrefs.net under the ahrefs.net domain, consistent with legitimate cloud infrastructure operations.

## Risk Assessment

No active threat indicators were identified. The IP is not classified as a known attacker, spam source, or proxy service.

## Network Context

Neighborhood Analysis (198.244.226.0/24):

• Total Active Siblings: 204
• Threat Siblings: 170
• Abuse Density: High (0.6641)
• Risk Classification: High Abuse

The parent subnet exhibits elevated abuse activity. While 198.244.226.26 itself shows no malicious indicators, 66% of active neighbors in the /24 subnet carry medium to high risk scores.

Related Network: Multiple relationships map to OVH_282347338, confirming the IP operates within OVH's broader cloud network.

## Observed Behavior

Service Exposure: None

• No open ports detected
• No HTTP/TLS services running
• Firewall configured (no service banner responses)

DNS Resolution: Single PTR record (proxy-uk002-san26.ahrefs.net) with forward resolution confirmed. No SPF/DMARC records observed.

Control Plane:

• BGP Prefix: 198.244.128.0/17
• Route Stability: False (indicates prefix changes)
• DNSBL Listed: 1 of 8 total lists
• RPKI State: Not Reported

## Historical Signals

25 observations recorded over the assessment period. Key temporal patterns:

• Consistent ownership attribution to Ahrefs infrastructure
• Persistent GB geolocation signals
• Subnet abuse density signals stable at high classification
• No evidence of persistent malicious activity

## Recommended Actions

Firewall Rule Recommendation:

```

# Allow Ahrefs proxy endpoint (monitor for abuse)

ACCEPT tcp dpt:80 src:198.244.226.26

ACCEPT tcp dpt:443 src:198.244.226.26

# Monitor subnet for correlated threats

LOG tcp src:198.244.226.0/24

```

## Assessment Notes

This IP represents legitimate cloud hosting infrastructure for a known SEO analytics provider (Ahrefs). The moderate risk score and single DNSBL listing likely relate to the high-abuse neighborhood context rather than direct malicious behavior. SOC teams should treat the IP as benign but monitor the parent subnet for coordinated abuse campaigns. No immediate blocking or defensive action is warranted against this specific endpoint.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.