198.244.240.226📋 Copy

## IP INTELLIGENCE BRIEFING

Target: 198.244.240.226/32

Date: 2026-06-20

Risk Classification: MODERATE RISK (Score: 40/100)

Provider: OVH Cloud Infrastructure

---

EXECUTIVE SUMMARY

IP address 198.244.240.226 is a cloud hosting endpoint associated with Ahrefs Pte Ltd Dmytro infrastructure, operating from OVH UK datacenters in London. While the IP itself shows moderate risk characteristics, it resides within a /24 subnet (198.244.240.0/24) with high abuse density (0.8242), indicating the broader network segment warrants monitoring. No active threat indicators were observed, but the IP is classified as hosting infrastructure with firewall-protected services.

---

INFRASTRUCTURE PROFILE

---

NEIGHBORHOOD ANALYSIS (198.244.240.0/24)

Abuse Environment: HIGH ABUSE CLASSIFICATION

• Abuse Density: 0.8242 (211 threat siblings out of 256 total)
• Active Siblings: 199 IPs observed
• Inherited Risk Score: 32
• Risk Distribution: High (0), Medium (27), Low (73)

Context: The target IP operates within a subnet showing elevated abuse patterns. While the specific IP has no active threat indicators, the neighborhood context suggests this infrastructure may be used for legitimate services alongside potentially compromised endpoints.

---

OBSERVATION HISTORY

Total Signals Observed: 19

Threat Persistence Days: 0

Is Persistently Malicious: No

Recent Signal Summary:

• Geolocation Inference: GB (England), confidence 0.28
• Subnet Classification: high_abuse (confidence 0.75)
• Network Role: OVH CloudCompute, confidence 0.85
• Operator Score: 0.2174 (Minimal), confidence 0.60

No escalation in threat activity detected. The IP has not demonstrated persistent malicious behavior patterns.

---

RELATIONSHIP GRAPH

Identified Relationships: 50

Primary Classification: Same Network (OVH_282347342)

The IP maintains network-level associations within the OVH hosting infrastructure. No external entity relationships (domains, organizations, certificates) were identified beyond the hosting provider network.

---

THREAT INDICATORS

---

RECOMMENDED ACTIONS

Risk-Based Recommendation: MONITOR

• Risk score of 40 indicates moderate concern, primarily driven by neighborhood abuse density
• No active threat indicators or malicious behavior observed
• Infrastructure appears legitimate but operates in high-abuse environment

Firewall Rule Recommendations:

```bash

# iptables

iptables -A INPUT -s 198.244.240.226 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.240.226 drop

# nginx

deny 198.244.240.226;

# pfSense

198.244.240.226/32

# Cloudflare WAF

{"description":"Block 198.244.240.226 — IPDebrief risk score 40","action":"block"}

# AWS WAF

{"Addresses":["198.244.240.226/32"],"Description":"IPDebrief risk 40"}

```

Note: These recommendations are probabilistic and should be combined with other security signals before implementing blocking rules. The IP may have legitimate use cases as hosting infrastructure.

---

ANALYST NOTES

1. Contextual Risk: While the IP shows moderate risk (40/100), the inherited risk from the /24 neighborhood (32) suggests broader network segment concerns rather than IP-specific threats.

2. Infrastructure Legitimacy: The PTR hostname (proxy-uk006-san226.ahrefs.net) and DNS domain (ahrefs.net) indicate legitimate association with Ahrefs, a known SEO analytics platform.

3. Action Priority: MEDIUM. Consider blocking if this IP appears in malicious traffic logs, but allow traffic if it originates from trusted sources. Monitor for behavioral changes.

4. Monitoring Recommendation: Track the IP for changes in threat indicators, DNSBL listings, or behavioral patterns. The subnet's high abuse density warrants periodic review of traffic from this /24 range.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.