51.195.183.156📋 Copy

# IP Intelligence Briefing: 51.195.183.156

## Executive Summary

IP address 51.195.183.156 was classified as Moderate Risk (score: 40) during analysis. The address belongs to Ahrefs Pte Ltd Dmytro, hosted on OVH infrastructure (ASN 16276) with geolocation indicators pointing to London, England. The IP operates as cloud compute infrastructure with no active open ports detected, suggesting it may be firewalled or in a non-service role.

## Ownership and Network Classification

The IP is registered to Ahrefs Pte Ltd Dmytro under ASN 16276 (OVH). Geolocation data indicates the address resides in GB, England, London, with a 750km accuracy radius. The network role classification identified the IP as cloud computing infrastructure (isCloud: true, isHosting: true) without CDN, VPN, proxy, or Tor exit node characteristics. The IP is not classified as bogon or mobile.

## DNS and Service Analysis

DNS resolution confirmed the IP to proxy-uk003-san156.ahrefs.net under the ahrefs.net domain. Forward resolution was confirmed for this single hostname. No email authentication records (SPF, DMARC) were detected. No open ports, TLS certificates, or HTTP services were observed, indicating the IP is either not publicly accessible or is actively firewalled.

## Threat Indicators and Risk Profile

The threat profile showed no direct indicators against this specific IP address. The abuse confidence score and known attacker flags were not set. The IP was not listed as a Tor exit node, known spam source, or associated with known campaigns. However, the control plane data revealed the IP is listed on 1 DNSBL out of 8 total lists tested, with an operator score of 0.2174 (labeled "Minimal"). Route stability was flagged as false with zero route changes observed in the prior 30 days.

## Neighborhood Analysis

The /24 subnet 51.195.183.0/24 was classified as high_abuse with an abuse density of 0.6836. Of 256 total sibling IPs, 195 were active and 175 were identified as threats. The inherited risk score for this subnet was 27. Neighbor analysis of 100 sampled addresses showed 99 with medium risk (score 40) and 1 with low risk, with no high-risk neighbors detected.

## Historical Observations

The IP generated 18 historical observations with threat signals observed as recently as June 2026. Key observations included:

• June 20, 2026: Threat indicators detected with 4 pulse names and 0.75 confidence
• June 15, 2026: High abuse classification confirmed with 0.6836 abuse density
• June 8, 2026: Geolocation inconsistencies noted (FR vs GB) with 0.28 confidence
• Multiple operator and routing assessments with varying confidence levels

## Recommended Security Actions

Based on the risk profile, the following firewall rules were generated:

iptables:

```

iptables -A INPUT -s 51.195.183.156 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 51.195.183.156 drop

```

nginx:

```

deny 51.195.183.156;

```

pfSense:

```

51.195.183.156/32

```

Cloudflare WAF:

```json

{

"description": "Block 51.195.183.156 — IPDebrief risk score 40",

"action": "block",

"filter": {"expression": "ip.src eq 51.195.183.156"}

}

```

AWS WAF:

```json

{

"Addresses": ["51.195.183.156/32"],

"Description": "IPDebrief risk 40"

}

```

## Intelligence Assessment

The IP 51.195.183.156 presents moderate risk within a high-abuse subnet. While the specific IP shows no direct threat indicators, the neighborhood context (68.36% abuse density, 175 threat siblings) warrants defensive caution. The lack of active services and firewalled posture suggests the IP may be part of infrastructure that does not require public access. SOC analysts should evaluate blocking recommendations in conjunction with local threat context and business requirements.

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.