51.195.183.37📋 Copy

# IP INTELLIGENCE BRIEFING: 51.195.183.37/32

Date: 2026-06-20

Classification: Moderate Risk

Risk Score: 50/100

---

## EXECUTIVE SUMMARY

Target IP 51.195.183.37 is a cloud-compute infrastructure address hosted on OVH (ASN 16276) in London, England. The IP is associated with the ahrefs.net domain and resolves to proxy-uk003-san37.ahrefs.net. While the individual IP shows moderate risk (score 50), the broader subnet 51.195.183.0/24 exhibits high abuse density (76.95%), with 197 of 225 active sibling IPs flagged as threats.

---

## TECHNICAL PROFILE

Ownership & Registration:

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• RIR: ARIN
• Infrastructure Type: CloudCompute (Hosting provider)

Geolocation:

• Country: United Kingdom (GB)
• Region: England, London
• RTT Validation: 87-92ms average, 500.4km from probe location
• Geo-Plausibility: Confirmed (5 probe measurements)

DNS Resolution:

• PTR Hostname: proxy-uk003-san37.ahrefs.net
• Forward Resolution: ahrefs.net domain confirmed
• Email Authentication: No SPF/DMARC records present

Network Classification:

• Cloud Provider: Yes (OVH)
• Hosting Service: Yes
• CDN/Proxy/VPN: No
• Tor Exit Node: No
• Open Ports: None detected

---

## THREAT INTELLIGENCE

Risk Assessment:

• Risk Score: 50 (Moderate)
• Provider Score: 0
• Authority Score: 0
• Operator Score: 0.2174 (Minimal)

Abuse Indicators:

• DNSBL Listings: 2/8 total lists
• Subnet Classification: High Abuse (51.195.183.0/24)
• Subnet Abuse Density: 76.95%
• Threat Siblings in Subnet: 197/225 active IPs

Campaign Indicators:

• Known Campaigns: None detected
• CERT Matches: 0
• Correlated IPs: 0
• Threat Persistence: Not persistent (0 threat observation days)

---

## OBSERVATION HISTORY

Total Observations: 22 signals recorded

Recent Activity (2026-06-20):

• 06:32:37 UTC: Subnet abuse density signal (0.7695, high_abuse classification)
• 06:27:53 UTC: Geo-location probe validated (London coordinates, 87-92ms RTT)
• 06:25:11 UTC: Operator score assessment (0.2174, Minimal)
• 06:25:00 UTC: Ownership stability check (no ownership changes detected)

Temporal Analysis:

• Ownership Changes: 0
• Threat Observation Count: 1
• Persistently Malicious: No

---

## SUBNET INTELLIGENCE (51.195.183.0/24)

Neighborhood Analysis:

• Total Siblings: 256
• Active Siblings: 225
• Threat Siblings: 197 (87.6% of active IPs)
• Sampled Neighbors: 100
• Sample Risk Distribution: 53 Medium Risk, 47 Low Risk

Key Neighbors (sample):

---

## RELATIONSHIP GRAPH

Total Relationships: 49 entries

Primary Associations:

• Multiple Same Network references to OVH_282347339 network block
• BGP Prefix: 51.195.0.0/16

---

## RECOMMENDED ACTIONS

Firewall/Blocking Rules:

*iptables:*

```

iptables -A INPUT -s 51.195.183.37 -j DROP

```

*nftables:*

```

nft add rule inet filter input ip saddr 51.195.183.37 drop

```

*nginx:*

```

deny 51.195.183.37;

```

*pfSense:*

```

51.195.183.37/32

```

*Cloudflare WAF:*

```json

{"description": "Block 51.195.183.37 — IPDebrief risk score 50", "action": "block", "filter": {"expression": "ip.src eq 51.195.183.37"}}

```

*AWS WAF:*

```json

{"Addresses": ["51.195.183.37/32"], "Description": "IPDebrief risk 50"}

```

---

## ANALYST NOTES

1. Subnet Context: The 51.195.183.0/24 subnet shows elevated abuse density (76.95%). SOC teams should consider blocking or rate-limiting traffic from the entire /24 subnet if the threat profile warrants.

2. Reputation Sources: No specific threat feeds or blacklist sources identified in the evidence. The risk score is primarily driven by subnet-level abuse patterns.

3. Operational Status: The IP shows no open ports or active services, suggesting it may be a reserved or infrastructure-only address. This reduces the likelihood of direct exploitation.

4. Verification: The London geolocation is validated via RTT measurements (87-92ms). Claims of UK origin are consistent with observed network behavior.

Assessment: This IP warrants blocking at perimeter defenses due to subnet-level abuse patterns. Individual threat activity is limited, but the operational environment presents elevated risk.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.