51.161.65.30📋 Copy

IP Intelligence Briefing: 51.161.65.30

Date: 2026-06-14

---

**1. Core Profile**

• Risk Score: 50 (Moderate Risk)
• Ownership:

- ASN: 16276 (OVH)

- Organization: Dmytro, Ahrefs Pte Ltd

- Network: 51.161.65.0/24 (OVH-CUST-281059690)

• Geolocation:

- Country: Canada (CA)

- City: Singapore

- Geo Validity: Plausible? False (RTT mismatch for distance).

• Threat Indicators:

- No malicious indicators, blacklists, or campaigns linked.

- DNS: Resolves to `proxy-ca011-san30.ahrefs.net` (Ahrefs, a legitimate SEO company).

---

**2. Network Behavior**

• Cloud Infrastructure:

- Hosted by OVH (cloud provider).

- Services: No open ports, no TLS certs, no HTTP services detected.

• Subnet Analysis:

- /24 Subnet: 51.161.65.0/24

- Abuse Density: 45.97% (moderate risk).

- Neighbors: 100 IPs in subnet; 92 low-risk, 8 medium-risk.

- Key Neighbors:

- 51.161.65.0 (risk: 40)

- 51.161.65.2 (risk: 50)

- 51.161.65.4 (risk: 50)

---

**3. Temporal Observations**

• Last 30 Days:

- Risk Trends: Stable (no spikes in threat signals).

- Geo Validation:

- RTT Anomalies: Observed 27ms RTT vs. expected 121.6ms for 6,082km distance.

- Probe Count: 5 probes (low confidence in geolocation accuracy).

• Ownership Stability: No changes in ownership.

---

**4. Relationships & Threat Context**

• Linked Entities:

- Network: OVH-CUST-281059690 (same subnet).

- DNS: Ahrefs Pte Ltd (legitimate, but DNSSEC and CAA records show mixed validation).

• Threat Correlation:

- No direct ties to known attackers, spam, or Tor networks.

- Subnet has 114 threat siblings (16.2% of neighbors).

---

**5. Actionable Insights**

• SOC Recommendations:

- Monitor Subnet: Track 51.161.65.0/24 for abnormal traffic patterns.

- Validate Geolocation: Investigate RTT discrepancies (potential spoofing or misconfigured routing).

- DNS Monitoring: Watch for DNS changes to `ahrefs.net` subdomains.

• Risk Mitigation:

- No immediate blocking required, but consider rate-limiting or monitoring for unexpected outbound traffic.

---

Summary:

This IP is associated with a legitimate cloud provider (OVH) and a SEO company (Ahrefs). While no direct malicious activity is detected, the subnet has a moderate abuse density, and geolocation anomalies warrant further investigation. Prioritize monitoring for unexpected behavior or lateral movements within the subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.