51.161.65.145📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 51.161.65.145/32

Date: June 26, 2026

Risk Classification: Moderate Risk (Score: 40/100)

Status: ACTIVE

---

## EXECUTIVE SUMMARY

IP 51.161.65.145 is a cloud hosting address registered to OVH (ASN 16276) with organization "Dmytro, Ahrefs Pte Ltd." The IP resolves to a hostname associated with ahrefs.net (proxy-ca011-san145.ahrefs.net), indicating proxy infrastructure. Despite legitimate enterprise association, the subnet demonstrates elevated abuse activity. Current risk assessment recommends blocking at perimeter defenses.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 51.161.65.0/24
• Infrastructure Type: CloudCompute / Hosting
• Connection Type: Cloud-based

---

## GEOLOCATION VALIDATION

• Reported Location: Montreal, QC, Canada
• RTT Validation: VIOLATION DETECTED

- Measured RTT: 27ms

- Minimum possible RTT for reported distance (6,082km): 121.6ms

- Violation indicates geographic misattribution or proxy usage

---

## THREAT INTELLIGENCE

Abuse Indicators:

• Single DNSBL listing detected
• Geo validation failure suggests potential anonymization or routing manipulation
• Subnet-level abuse density: 0.5547 (High Abuse Classification)

---

## NETWORK CONTEXT

Subnet Analysis (51.161.65.0/24):

• Total IPs: 256
• Active IPs: 218 (85.2% utilization)
• Threat Siblings: 142 (55.47% abuse density)
• Classification: HIGH_ABUSE

Relationship Network:

• 64 relationships identified
• Primary association: OVH-CUST-281059690

---

## OBSERVATION HISTORY

Total observations: 23

Recent signals (June 26, 2026):

• Consistent OVH hosting classification
• Persistent high_abuse subnet classification
• No new threat indicators emerged

---

## RECOMMENDED ACTIONS

Perimeter Defense - Block Immediately:

```bash

# iptables

iptables -A INPUT -s 51.161.65.145 -j DROP

# nftables

nft add rule inet filter input ip saddr 51.161.65.145 drop

# Nginx

deny 51.161.65.145;

# pfSense

51.161.65.145/32

# Cloudflare WAF

ip.src eq 51.161.65.145

# AWS WAF

Addresses: 51.161.65.145/32

```

Additional Context for SOC Analysts:

• The hostname "proxy-ca011-san145.ahrefs.net" indicates this may be proxy infrastructure for ahrefs.net services
• While the organization is legitimate, the subnet shows elevated abuse patterns typical of shared hosting environments
• Geographic validation failure suggests the IP may be routed through intermediate nodes or used for proxy services
• Consider blocking at network perimeter and monitoring for lateral movement to related IPs in the 51.161.65.0/24 subnet

---

Report Generated: IPDebrief Intelligence Platform

Classification: Internal Threat Intelligence

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.