198.244.226.62📋 Copy

# IP Intelligence Briefing: 198.244.226.62

Date: 2026-06-28

Classification: Moderate Risk

Risk Score: 40/100

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP 198.244.226.62 is a firewalled hosting endpoint registered to Ahrefs Pte Ltd Dmytro under ASN 16276 (OVH SAS). While the IP currently shows no active blacklist listings, historical signals indicate threat activity and the associated /24 subnet demonstrates elevated abuse density. The IP resolves to ares.net infrastructure proxy hostname with no exposed services, suggesting defensive hardening but potential abuse as a proxy or relaying endpoint.

---

## Technical Profile

Ownership & Infrastructure:

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH SAS)
• RIR: ARIN
• Location: London, England, GB
• Infrastructure Type: Cloud Hosting (OVH)
• Geolocation Consensus: Inconsistent across sources (geoPlausible: true, geoConsensus: false)

Network Classification:

• Provider: OVH
• Network Role: Hosting / Cloud Infrastructure
• Connection Type: Cloud Compute
• Firewall Status: Active (no open ports detected)
• DNS: proxy-uk002-san62.ahrefs.net (forward resolution confirmed)

Threat Indicators:

• Current Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None identified
• Historical Threat Observations: 1 signal

---

## Network Neighborhood Assessment

Subnet: 198.244.226.0/24

• Abuse Density: 0.7383 (High Abuse Classification)
• Inherited Risk Score: 29/100
• Total Subnet Siblings: 256
• Active Siblings: 214
• Threat Sibling Count: 189
• Risk Distribution: High (0), Medium (43), Low (57)

The parent subnet exhibits significant abuse concentration with 73% of active endpoints flagged as threat indicators. This contextualizes 198.244.226.62 within a compromised network segment.

---

## Observation History

Total Observations: 25 signals

Most Recent Activity: 2026-06-28

Key Historical Signals:

1. Threat Indicators: Multiple pulse feed detections observed on 2026-06-28

2. Provider Classification: OVH cloud hosting confirmed with high confidence (0.90)

3. Subnet Classification: High abuse density (0.7383) documented on 2026-06-20

4. Operator Score: 0.2174 (Minimal label)

---

## Relationship Graph

Total Relationships: 53

• Network Relationships: Multiple connections to OVH network OVH_282347338
• Infrastructure Linkage: Strong correlation to OVH hosting infrastructure

The IP demonstrates extensive network-level relationships consistent with OVH hosting infrastructure, with no evidence of organizational separation from parent network.

---

## Recommended Actions

Risk Threshold: 40/100 (Moderate Risk)

Blocking Recommendations:

```bash

# iptables

iptables -A INPUT -s 198.244.226.62 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.226.62 drop

# nginx

deny 198.244.226.62;

# pfSense

198.244.226.62/32

# Cloudflare WAF

ip.src eq 198.244.226.62 (action: block)

# AWS WAF

Addresses: ["198.244.226.62/32"]

```

---

## Intelligence Assessment

Threat Level: Moderate

Action Required: Block recommended pending additional context

Key Findings:

1. Subnet Context: The /24 subnet (198.244.226.0/24) demonstrates high abuse density with 189 threat-sibling IPs, indicating potential infrastructure compromise or abuse of legitimate hosting resources

2. Current Status: No active blacklist listings or service exposure detected

3. Historical Signals: Threat activity documented in recent observation window

4. Infrastructure: Legitimate hosting infrastructure (ahrefs.net) but deployed in high-risk network segment

Recommendation: Apply blocking rules as recommended. Monitor for changes in threat profile or emergence of active services. Consider subnet-level filtering if traffic patterns warrant broader restrictions.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.