51.195.183.112
## INTELLIGENCE BRIEFING: 51.195.183.112/32
Classification: Moderate Risk | Status: Active Hosting Infrastructure
Executive Summary
IP address 51.195.183.112 is identified as cloud hosting infrastructure operated by OVH (ASN 16276) on behalf of Ahrefs Pte Ltd. The IP resolves to proxy-uk003-san112.ahrefs.net and is located in London, England. While the IP shows moderate risk (score: 40) and no direct threat indicators, it operates within a high-abuse-density subnet (51.195.183.0/24) with 77% abuse classification.
Technical Profile
- Organization: Ahrefs Pte Ltd Dmytro (OVH)
- Infrastructure Type: Cloud Compute / Hosting
- Geolocation: London, England, GB (Rtt: 86-90ms from observation points)
- DNS Resolution: proxy-uk003-san112.ahrefs.net (ahrefs.net domain)
- Network Role: Firewalled / No services exposed
- Risk Score: 40 (Moderate)
- Provider Score: 0 (No provider-specific malicious activity)
- Authority Score: 0
Threat Assessment
The IP shows no direct malicious indicators:
- Blacklist Status: 0 direct blacklists, 1 DNSBL listing (of 8 total lists)
- Tor Exit: No
- Known Attacker: No
- Spam Source: No
- Campaign Association: None detected
- Persistence: Not persistently malicious
The elevated risk profile (40/100) is primarily inherited from the subnet-level abuse density rather than IP-specific malicious activity.
Subnet Context
The /24 subnet (51.195.183.0/24) exhibits concerning abuse characteristics:
- Abuse Density: 76.95% (High Abuse classification)
- Active Siblings: 225 of 256 IPs
- Threat Siblings: 197 identified threat-related neighbors
- Risk Distribution: 11 medium-risk, 89 low-risk siblings
This indicates the subnet is heavily utilized for cloud hosting with elevated abuse rates.
Observation History
23 historical signals observed with consistent identification:
- Provider consistently identified as OVH hosting
- Geolocation consistently resolved to GB (London)
- DNS resolution stable to ahrefs.net infrastructure
- No significant reputation degradation observed
Recommended Actions
Based on risk profile and subnet context, consider the following:
| Platform | Recommendation |
|---|---|
| iptables | `iptables -A INPUT -s 51.195.183.112 -j DROP` |
| nftables | `nft add rule inet filter input ip saddr 51.195.183.112 drop` |
| nginx | `deny 51.195.183.112;` |
| pfSense | `51.195.183.112/32` |
| Cloudflare WAF | Block with description: "IPDebrief risk score 40" |
| AWS WAF | Add to block list: 51.195.183.112/32 |
Note: These recommendations should be combined with other threat signals before deployment. The IP operates legitimate Ahrefs infrastructure but within a high-abuse-density environment.
---
*Intelligence generated by IPDebrief analysis tools. Verify with additional signals before enforcement.*
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Ahrefs Pte Ltd Dmytro |
| ASN | AS16276 |
| Network Name | — |
| CIDR Block | — |
| RIR | ARIN |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | proxy-uk003-san112.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-uk003-san112.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 29% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 12% | 2 | 2 |
| ownership | 24% | 2 | 3 |
| reputation | 31% | 1 | 3 |
| geolocation | 33% | 2 | 3 |
| Overall | 24% | 10 | 16 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-23 06:23:01 UTC |
| Last Seen | 2026-06-28 20:41:42 UTC |
| Profile Built | 2026-06-29 08:45:59 UTC |
| Data Freshness | Live |
| Signal Types | 23 |
| Total Observations | 26 |
Full dossier details are available via our API.