51.195.183.197📋 Copy

# IP Intelligence Briefing: 51.195.183.197

## Executive Summary

IP address 51.195.183.197 is a cloud-compute infrastructure node operated by OVH, registered to Ahrefs Pte Ltd (Dmytro). The asset demonstrates moderate risk characteristics (Risk Score: 40) with no open services, but exhibits concerning patterns including DNSBL listings and high-abuse subnet classification. SOC analysts should monitor for potential policy violations rather than immediate threat activity.

## Ownership and Infrastructure

The IP resolves to hostname `proxy-uk003-san197.ahrefs.net` within the `ahrefs.net` domain. No active services are detected; the node is firewalled with no open ports.

## Threat Assessment

Control plane analysis indicates the IP is listed on 1 DNS blacklist out of 8 total lists reviewed. The abuse confidence score remains uncalculated. No known attack campaigns or threat indicators are associated with this address.

## Neighborhood Analysis

The IP resides in subnet 51.195.183.0/24, which exhibits elevated abuse activity:

• Abuse Density: 58.6%
• Classification: High Abuse
• Inherited Risk Score: 23
• Total Siblings: 256
• Active Siblings: 150
• Threat Siblings: 150

Risk distribution across the subnet shows 99 medium-risk neighbors and 1 low-risk neighbor, with no high-risk neighbors currently flagged.

## Historical Trends

Observation history captures 24 signal instances, with the most recent data (June 2026) showing:

• Abuse density fluctuated between 0.707 and baseline levels
• Classification remained consistently "high_abuse"
• Max DNSBL listing severity: High
• Domain CAA records present with 1 issuer

Temporal analysis indicates 0 ownership changes and 0 threat persistence days, suggesting the IP is not persistently malicious but maintains elevated risk characteristics.

## Recommended Actions

## Intelligence Notes

While the infrastructure is registered to Ahrefs—a legitimate SEO analytics platform—the IP demonstrates behavioral patterns inconsistent with typical enterprise operations. The high DNSBL listing count and subnet abuse density warrant continued monitoring. No immediate blocking is recommended, but traffic should be logged and reviewed for policy compliance.

---

*Report generated: June 2026*

*Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.