198.244.226.61📋 Copy

IP Intelligence Briefing: 198.244.226.61

Date: 2026-06-09

---

**1. Risk Profile**

• Overall Risk: Moderate (Risk Score: 40)
• Ownership:

- ASN: AS16276 (OVH)

- Organization: Ahrefs Pte Ltd Dmytro

- Geolocation: London, England, UK (latitude 55.38, longitude -3.44)

• Threat Indicators:

- No direct malicious indicators (no malware, phishing, or spam associations).

- Subnet abuse density: 0.5977 (high abuse classification).

- 153 threat siblings in the /24 subnet.

---

**2. Network & Infrastructure**

• Network Role:

- Cloud compute instance (OVH infrastructure).

- Hosting services (no open ports or TLS certificates detected).

• Control Plane:

- BGP prefix: 198.244.128.0/17

- Route stability: Unstable (low confidence in routing consistency).

- DNSSEC valid,CAA records present.

---

**3. Observation History (30-Day Trend)**

• Key Findings:

- Subnet abuse density remained consistent at 0.5977 (high abuse).

- Geolocation inferred as London, UK (accuracy radius: 750 km).

- Linked to OVH network (AS16276) with threat persistence.

- DNSBL listing (1 of 8 lists) with low severity.

- No significant changes in risk or activity patterns.

---

**4. Relationships**

• Network Associations:

- OVH_282347338 (same network).

- DNS hostname: `proxy-uk002-san61.ahrefs.net` (Ahrefs infrastructure).

• Threat Context:

- No direct campaign or malware associations.

---

**5. Neighborhood Analysis**

• Subnet: 198.244.226.61/24
• Abuse Density:

- High (153 threat siblings out of 256 total IPs).

- 152 active IPs in subnet, with 98% medium/low risk and 2% high risk.

• Actionable Insight:

- Subnet may host compromised or malicious activity. Monitor for lateral movement or traffic anomalies.

---

**6. Recommendations**

1. Monitor Subnet Activity:

- Investigate the high abuse density in the subnet. Check for unusual traffic patterns or lateral movement.

2. Validate DNS Associations:

- Confirm the purpose of `proxy-uk002-san61.ahrefs.net` and ensure it aligns with Ahrefs' legitimate infrastructure.

3. Review Routing Stability:

- Address route instability (BGP prefix 198.244.128.0/17) to prevent potential hijacking.

4. Block High-Risk Neighbors:

- Consider blocking IPs with high risk scores in the subnet if they are not authorized.

---

Source: IPDebrief Threat Intelligence Platform

Note: This briefing reflects current data as of 2026-06-09. Continuous monitoring is recommended for dynamic threat environments.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.