151.80.61.151📋 Copy

# Intelligence Briefing: 151.80.61.151/32

Classification: MODERATE RISK | Last Updated: 2026-06-14

---

## Executive Summary

IP 151.80.61.151 is a cloud-hosted infrastructure endpoint associated with OVH SAS (ASN 16276), located in Roubaix, France. The IP demonstrates moderate risk (Score: 50) due to DNSBL listings, though the surrounding /24 subnet remains classified as "mostly_clean" with zero threat siblings. No active malicious campaigns or correlation with known attacker infrastructure have been identified.

---

## Infrastructure Profile

---

## Technical Observations

DNS Resolution:

• Primary hostname: `vps-5d95afd4.vps.ovh.net`
• Forward resolution confirmed: Yes
• SPF/DMARC: Configured (SPF: true, DMARC: true)

Service Enumeration:

• Port 22/TCP: SSH (OpenSSH 10.0p2 Debian-7~bpo12+1)
• Web Server: nginx/1.18.0 (HTTP/1.1)
• TLS Certificate: None detected
• HTTP Status: 200 (Generator: Odoo)

---

## Threat Indicators

Control Plane:

• BGP Prefix: 151.80.0.0/16
• Route Stability: False
• RPKI State: Not validated
• DNSSEC: Valid

---

## Temporal Analysis

Observation History:

• Total Observations: 23
• Recent Activity: 2026-06-14
• Threat Observation Count: 1
• Threat Persistence: 0 days
• Ownership Changes: 0

The IP has demonstrated persistent ownership with no recent changes to infrastructure ownership.

---

## Neighborhood Assessment

Subnet: 151.80.61.0/24

• Abuse Density: 0 (Clean)
• Classification: Mostly Clean
• Threat Siblings: 0
• Active Siblings: 1 (same IP)

The surrounding subnet shows no elevated threat density, suggesting this IP operates in isolation without coordinated neighbor activity.

---

## Relationship Graph

Total Relationships: 65

• DNS Associations: Multiple entries to `vps-5d95afd4.vps.ovh.net`
• Network Associations: OVH infrastructure
• No external organizational or certificate relationships detected

---

## Recommended Actions

---

## Intelligence Notes

1. Cloud Environment: This IP operates within OVH's cloud infrastructure, which may limit investigation capabilities.

2. DNSBL Presence: The 2 DNSBL listings warrant monitoring but do not indicate active malicious activity.

3. Geolocation Consistency: 5 probe signals confirm France location with ~307km validation distance.

4. No Campaign Correlation: Zero matches with known threat campaigns or correlated malicious IPs.

Status: Monitor | Confidence: High

---

*This briefing is based on IPDebrief intelligence data as of 2026-06-14. All data should be validated against internal threat intelligence sources before operational decision-making.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.