198.244.240.61📋 Copy

# IP INTELLIGENCE BRIEFING: 198.244.240.61

## Executive Summary

IP address 198.244.240.61 is a cloud compute infrastructure endpoint operated by OVH (ASN 16276) for Ahrefs Pte Ltd, located in London, GB. The IP presents moderate risk (score: 50) with active blacklist presence and operates within a high-abuse density subnet.

## Risk Assessment

• Overall Risk Score: 50 (Moderate Risk)
• Infrastructure Type: CloudCompute (OVH hosting provider)
• Service Status: Firewalled / No active services detected
• DNS Resolution: proxy-uk006-san61.ahrefs.net (forward confirmation: false)
• Geolocation: London, England, GB (accuracy radius: 750km)

## Threat Indicators

• Blacklist Status: Listed on 2 of 8 DNSBL feeds
• Known Campaigns: None detected
• Abuse Confidence Score: Not available
• Campaign Correlation: No correlated IPs or certificate matches

## Network Context

• Subnet Classification: 198.244.240.0/24 — High abuse density (0.6406)
• Threat Siblings: 164 out of 256 IPs in subnet flagged as threats
• Inherited Risk Score: 25 from neighborhood analysis
• Control Plane: BGP prefix 198.244.128.0/17, origin ASN 16276

## Historical Activity

• Observation Count: 18 signals tracked
• Recent Activity: Multiple high-severity blacklist listings observed (June 2026)
• Threat Persistence: No persistent malicious behavior pattern detected
• Ownership Stability: No ownership changes recorded

## Infrastructure Relationships

• Primary Hostname: proxy-uk006-san61.ahrefs.net
• DNS Associations: 14 DNS link entries to same hostname
• Network Affiliation: Multiple relationships to OVH_282347342 network

## Recommended Actions

Based on risk profile and threat indicators, the following controls are recommended:

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 198.244.240.61 -j DROP

# nftables

nft add rule inet filter input ip saddr 198.244.240.61 drop

```

WAF/Proxy Recommendations

• Cloudflare WAF: Block IP with expression: `ip.src eq 198.244.240.61`
• AWS WAF: Create rule for CIDR 198.244.240.61/32

Network-Specific Rules

• pfsense: 198.244.240.61/32
• nginx: `deny 198.244.240.61;`

## Analyst Notes

1. Contextual Risk: While the IP resolves to legitimate ahrefs.net infrastructure, the subnet demonstrates elevated abuse activity. Correlate with observed threat context before blocking.

2. Subnet Considerations: The /24 subnet contains 164 threat-sibling IPs; consider evaluating broader subnet-level policies if business context permits.

3. Verification: Forward DNS confirmation failed—validate current operational status through secondary sources.

4. Business Impact: Ahrefs is a legitimate SEO analytics provider; assess whether blocking aligns with organizational threat tolerance and threat correlation data.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.