51.195.215.117📋 Copy

# IP INTELLIGENCE BRIEFING: 51.195.215.117/32

## Executive Summary

IP 51.195.215.117 presents MODERATE RISK with a risk score of 50. The address is hosted on OVH cloud infrastructure in London, GB, operating under the domain ahrefs.net. While the IP itself shows no active threat indicators, its subnet (51.195.215.0/24) is classified as HIGH ABUSE with 80.08% abuse density.

## Ownership & Infrastructure

• Organization: Ahrefs Pte Ltd Dmytro (ASN 16276)
• Provider: OVH (CloudCompute infrastructure)
• Location: London, England, GB
• DNS Hostname: proxy-uk009-san117.ahrefs.net
• Network Block: 51.195.0.0/16 (origin ASN 16276)

## Risk Assessment

## Neighborhood Analysis

The 51.195.215.0/24 subnet demonstrates concerning abuse characteristics:

• Abuse Density: 0.8008 (HIGH ABUSE CLASSIFICATION)
• Total Subnet IPs: 256
• Active Siblings: 239 (93% active)
• Threat Siblings: 205 (86% of active IPs)
• Risk Distribution: 53 medium-risk, 47 low-risk neighbors

## Observations

Signal history shows 17 observations recorded. Most recent activity (2026-06-20) indicates:

• Multiple blacklist listings with high severity
• Subnet abuse density confirmed at 0.8008
• Operator score: 0.2174 (Minimal)

## Network Relationships

• 27 total relationships identified
• Multiple associations with network OVH_282347345
• Consistent DNS associations to proxy-uk009-san117.ahrefs.net
• No certificate or organizational relationship matches

## Threat Indicators

• Not: Tor exit node, known attacker, spam source
• No: Active threat campaigns detected
• No: Known malicious behavior in threat feeds

## Recommended Actions

Based on risk profile and neighborhood context, the following controls are recommended:

```bash

# Firewall Blocking

iptables -A INPUT -s 51.195.215.117 -j DROP

nft add rule inet filter input ip saddr 51.195.215.117 drop

# Application-Level

nginx: deny 51.195.215.117;

Cloudflare WAF: Block 51.195.215.117 — IPDebrief risk score 50

AWS WAF: Addresses [51.195.215.117/32]

```

## Analyst Notes

While the IP shows no direct threat indicators, the high-abuse subnet classification suggests this address may be part of a compromised cloud hosting infrastructure. The moderate risk score (50) combined with 8 DNSBL listings warrants blocking at perimeter controls. Consider implementing subnet-level filtering (51.195.215.0/24) if organizational policy permits, given the 86% threat sibling rate in the neighborhood.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.