51.195.183.226📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 51.195.183.226/32

Classification: Moderate Risk (Score: 40)

Report Generated: 2026-06-20

---

## EXECUTIVE SUMMARY

IP 51.195.183.226 is a cloud hosting infrastructure endpoint operated by Ahrefs Pte Ltd (OVH Network, ASN 16276) with a moderate risk score of 40. The IP is geolocated to London, England and resolves to the ahrefs.net domain. No active threat indicators were detected; however, the IP operates within a high-abuse density subnet (51.195.183.0/24) with 66.8% abuse density and 171 threat-identified sibling IPs out of 256 total addresses.

---

## INFRASTRUCTURE PROFILE

---

## THREAT INDICATORS

• Known Campaigns: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Status: Listed on 1 of 8 DNSBL providers

While the IP itself carries no active threat indicators, the subnet exhibits elevated abuse characteristics with 171 threat-sibling IPs.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 51.195.183.0/24

Abuse Density: 0.668 (High)

Total Siblings: 256

Active Siblings: 195

Threat Siblings: 171

The /24 subnet shows concentrated abuse activity. Risk distribution across siblings: 69 medium-risk, 31 low-risk, 0 high-risk IPs. This suggests the subnet is actively utilized for hosting services but with mixed compliance profiles.

---

## OBSERVATION HISTORY

25 signal observations recorded over recent monitoring period. Most recent signals (2026-06-20):

• Routing Classification: Basic (Operator Score: 0.4)
• Geolocation Confidence: 0.25 (Multi-signal inference)
• DNS Records: CAA records present, domain ahrefs.net confirmed
• Network Classification: Cloud/Hosting (OVH provider)

Route stability confirmed with no observed changes in the past 9244 days. DNSSEC valid with CAA records present.

---

## RELATED ENTITIES

82 relationships identified, primarily network-level associations (OVH_282347339). No correlated malicious campaigns or shared certificate subjects observed.

---

## RECOMMENDED ACTIONS

Based on risk profile and neighborhood context, the following mitigations are recommended:

Note: These recommendations are probabilistic and should be combined with other signals before taking action.

---

## ANALYST NOTES

The IP exhibits typical cloud hosting behavior with no evidence of malicious activity. However, the high-abuse-density subnet warrants monitoring. Consider implementing subnet-level rate limiting or geolocation filtering if broader threat patterns emerge. The ahrefs.net association suggests legitimate SEO analytics infrastructure, but the subnet's abuse profile requires ongoing surveillance.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.