51.161.65.220📋 Copy

IP Intelligence Briefing: 51.161.65.220

Date: 2026-06-03

---

**1. Core Profile**

• Risk Score: 25 (Low Risk)
• Provider: OVH (ASN 16276)
• Organization: Dmytro, Ahrefs Pte Ltd
• Geolocation:

- Country: Canada (CA) | City: Singapore

- Coordinates: Unspecified | Accuracy Radius: 3,000 km

• Network Role: Hosting provider (firewalled, no services detected)
• Threat Indicators: No malicious activity detected (no blacklists, spam, or campaigns).

---

**2. Observation History**

• Latest Scan: 2026-06-03 (no open ports, no TLS/http services).
• Subnet Abuse Density: 45.97% (moderate risk).
• Historical Trends:

- First observed on 2026-05-30 (port scan with no active services).

- Subnet abuse density increased to 45.97% in the last 30 days.

• Stability: Route instability detected (0.2174 operator score).

---

**3. Relationships**

• Network Connections:

- Linked to OVH network (OVH-CUST-281059690).

- Subnet: 51.161.65.0/24 (248 IPs, 114 flagged as threats).

• DNS:

- PTR hostname: `proxy-ca011-san220.ahrefs.net` (hosted by Ahrefs).

- No email auth (SPF/DKIM) detected.

---

**4. Neighborhood Analysis**

• Subnet: 51.161.65.0/24
• Risk Distribution:

- High Risk: 0 IPs

- Medium Risk: 78 IPs

- Low Risk: 22 IPs

• Abuse Density: 45.97% (elevated for a /24 subnet).
• Neighbors:

- 114 IPs flagged as threats (e.g., 51.161.65.0, 51.161.65.2, 51.161.65.4).

- 160 active IPs in subnet, 248 total.

---

**5. Threat Context**

• No Direct Malicious Activity: No indicators of compromise (IOC), spam, or campaigns.
• Subnet Risk: Elevated abuse density suggests potential for lateral movement or shared infrastructure risks.
• Geolocation Discrepancy: Conflicting country (CA) and city (Singapore) data may indicate data entry errors or misconfigured geolocation.

---

**6. Recommendations**

1. Monitor Subnet: Track high-risk neighbors (e.g., 51.161.65.0, 51.161.65.2) for suspicious activity.

2. Verify Geolocation: Cross-check IP location with additional sources (e.g., WHOIS, DNS records).

3. Network Segmentation: Isolate this subnet if it hosts critical assets to mitigate potential lateral attacks.

4. DNS Monitoring: Investigate `proxy-ca011-san220.ahrefs.net` for domain hijacking or misconfiguration risks.

---

Source: IPDebrief Threat Intelligence Platform | Last Updated: 2026-06-03

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.