51.161.37.127📋 Copy

# IP Intelligence Briefing: 51.161.37.127/32

## Executive Summary

IP 51.161.37.127 is a cloud-hosted infrastructure endpoint associated with Ahrefs Pte Ltd, deployed on OVH network infrastructure in Montreal, Canada. The IP exhibits moderate risk (score: 40/100) with high-abuse classification for its /24 subnet. No active malicious indicators or known attack campaigns were identified.

## Infrastructure Profile

## Network Classification

• Provider: OVH (major cloud hosting provider)
• Service Status: Firewalled / No Services detected
• Open Ports: None identified
• TLS Certificate: Not present
• HTTP Banner: No active web service detected

## DNS Resolution

• PTR Hostname: proxy-ca005-san127.ahrefs.net
• Resolving Domain: ahrefs.net
• Forward Resolution: Confirmed (1 hostname)
• Email Authentication: SPF/DMARC records not configured

## Threat Indicators

• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None correlated
• DNSBL Listed: 1 of 8 total lists

## Neighborhood Analysis (51.161.37.0/24)

• Total Siblings: 256 IPs in /24
• Active Siblings: 205
• Threat Siblings: 189
• Abuse Density: 0.7383 (High)
• Inherited Risk: 29
• Risk Distribution: 99 medium, 1 low, 0 high risk neighbors

## Historical Signals (23 observations)

Recent activity observed from 2026-06-18:

• Subnet abuse density consistently high (0.7383)
• Operator score: 0.2174 (Minimal)
• Domain resolution stable for ahrefs.net
• Geo signals show Canada (QC) with low confidence (0.175)

## Control Plane Status

• BGP Prefix: 51.161.0.0/17
• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not evaluated
• DNSSEC Valid: Yes
• CAA Records: Present (1 issuer)

## Recommended Security Actions

1. Monitor subnet-level activity: 73.83% abuse density indicates elevated activity in the /24

2. No immediate blocking recommended: No active threat indicators or blacklist presence

3. Investigate reverse DNS: PTR hostname (proxy-ca005-san127.ahrefs.net) may warrant correlation with Ahrefs threat intelligence

4. Verify service posture: No open ports detected; confirm intended cloud service usage

## Analyst Notes

• IP is legitimately associated with Ahrefs web infrastructure (ahrefs.net)
• High abuse density in /24 subnet is common for cloud hosting environments
• RTT validation indicates geolocation data may be imprecise (27ms observed vs 121.6ms minimum for 6082km)
• No evidence of malicious activity or command-and-control patterns

Classification: MODERATE RISK — Legitimate cloud infrastructure with elevated neighborhood risk

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.