51.161.65.36📋 Copy

IP Intelligence Briefing: 51.161.65.36/32

*Generated via IPDebrief Analysis*

---

**Core Profile**

• Risk Score: 25 (Low Risk)
• Ownership:

- ASN: AS16276 (OVH)

- Organization: "Dmytro, Ahrefs Pte Ltd"

- Subnet: 51.161.65.0/24 (OVH-CUST-281059690)

• Geolocation:

- Montreal, Quebec, Canada (CA)

- Latitude: 45.4995, Longitude: -73.5848

• Network Role:

- Cloud compute infrastructure (OVH)

- Hosting services (no public services detected)

- No CDN, VPN, or Tor association

---

**Threat Indicators**

• No direct malicious activity:

- No DNS, TLS, or service anomalies detected.

- No known campaigns, blacklists, or honeypot hits.

• Subnet Risk:

- Abuse Density: 45.97% (mixed risk)

- Threat Siblings: 114/248 IPs in subnet flagged as risky.

- Recent observation (June 14) shows increased abuse density (58.98%).

---

**Observation History**

• Stability: Route stability inconsistent (stable for 30 days, but flagged as "mixed").
• Temporal Trends:

- No persistent malicious behavior.

- Subnet abuse density rose from 45.97% (June 3) to 58.98% (June 14).

---

**Network Relationships**

• Linked Entities:

- Same network: OVH-CUST-281059690 (248 IPs).

- Associated domain: `ahrefs.net` (PTR hostname: `proxy-ca011-san36.ahrefs.net`).

• Control Plane:

- BGP prefix: 51.161.0.0/17

- DNSSEC validated, CAA records present.

- 1 DNSBL listing (out of 8 total).

---

**Subnet Neighborhood**

• Neighbor Risk Distribution:

- High Risk: 0 IPs

- Medium Risk: 80 IPs

- Low Risk: 20 IPs

• Active Siblings: 160 IPs in subnet (114 flagged as threats).
• Notable Neighbors:

- 51.161.65.0 (risk score: 40),

- 51.161.65.2 (risk score: 50).

---

**Actionable Insights**

1. Monitor Subnet: The 51.161.65.0/24 subnet shows increasing abuse density. Investigate correlated IPs (114 threats) for potential lateral movement or botnet activity.

2. Verify Hosting: The IP is part of OVH cloud infrastructure. Confirm if it hosts legitimate services (e.g., Ahrefs) or is used for malicious purposes.

3. Check DNS: The PTR hostname `proxy-ca011-san36.ahrefs.net` may indicate a proxy or load balancer. Validate if this aligns with Ahrefs' infrastructure.

4. No Immediate Action Required: The IP itself is low risk, but its subnet warrants closer scrutiny due to mixed risk indicators.

---

*End of Briefing*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.