51.161.65.150📋 Copy

# IP Intelligence Briefing: 51.161.65.150/32

Date: 2026-06-18

IP Address: 51.161.65.150

Risk Score: 40/100 (Moderate Risk)

Classification: Hosting Infrastructure

## Executive Summary

IP address 51.161.65.150 is a hosting infrastructure endpoint operated by OVH SAS (ASN 16276) under customer OVH-CUST-281059690. The IP is associated with Ahrefs.net domain infrastructure and resolves to proxy-ca011-san150.ahrefs.net. While the IP carries no direct threat indicators, it operates within a high-abuse subnet with 72.66% abuse density and 186 of 256 sibling IPs flagged as threats.

## Technical Profile

Ownership & Network:

• ASN: AS16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 51.161.65.0/24
• Network Name: OVH-CUST-281059690
• RIR: ARIN

Geolocation:

• Country: Canada (CA)
• Region: Quebec (QC)
• City: Montreal
• Geolocation confidence: Mixed (2 sources, consensus true, geoPlausible false)
• RTT Analysis: 27ms observed vs 121.6ms minimum possible for 6082km distance indicates geolocation discrepancy

DNS Resolution:

• PTR Hostname: proxy-ca011-san150.ahrefs.net
• Forward Resolution: 1 confirmed hostname
• Email Authentication: No SPF/DMARC records configured
• CAA Records: Present and valid
• DNSSEC: Valid

Network Services:

• Open Ports: None detected
• Connection Type: Firewalled / No Services
• Infrastructure Type: Hosting provider

## Threat Assessment

Current Risk Indicators:

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence Score: Not calculated
• Blacklist Count: 0
• Pulsedive Risk: Not assessed
• Known Campaigns: None
• Tor Exit: No
• Known Attacker: No
• Spam Source: No

Control Plane Analysis:

• Operator Score: 0.2174 (Minimal)
• DNSBL Listed: 1 of 8 total lists
• Route Stability: Not stable
• RPKI State: Not assessed
• Route Changes (30d): 0

## Neighborhood Analysis

The IP operates within subnet 51.161.65.0/24, which exhibits elevated abuse characteristics:

• Total Siblings: 256
• Active Siblings: 212
• Threat Siblings: 186
• Subnet Abuse Density: 0.7266 (High Abuse Classification)
• Inherited Risk Score: 29

Risk distribution among neighbors: 98 medium-risk, 2 low-risk, 0 high-risk. This pattern suggests the subnet hosts legitimate hosting infrastructure alongside malicious endpoints.

## Observation History

23 historical observations recorded with recent activity on 2026-06-18:

• Subnet abuse density consistently classified as "high_abuse"
• ASN AS16276 (OVH SAS) consistently reported
• Montreal, QC geolocation maintained across observations
• Ahrefs.net domain associations present
• Operator scores remained minimal (0.2174)
• No persistent malicious behavior detected (threatPersistenceDays: 0)

## Security Recommendations

Based on risk profile and neighborhood context, the following actions are recommended:

Immediate Actions:

• Block IP at perimeter firewall (iptables/nftables)
• Deny in WAF rules (Cloudflare, AWS WAF)
• Monitor for outbound connections from this IP

Recommended Firewall Rules:

```

iptables -A INPUT -s 51.161.65.150 -j DROP

nft add rule inet filter input ip saddr 51.161.65.150 drop

```

Monitoring Considerations:

• Watch for DNS queries to ahrefs.net infrastructure
• Monitor for patterns consistent with proxy usage
• Track subnet-wide abuse trends in 51.161.65.0/24

## Intelligence Conclusion

IP 51.161.65.150 is a legitimate hosting endpoint with moderate risk scoring due to its high-abuse neighborhood context. No direct threat indicators were observed, but the subnet's 72.66% abuse density and 186 threat-sibling IPs warrant defensive positioning. The IP should be blocked or rate-limited at defensive perimeters, with continued monitoring for behavior changes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.