51.195.215.152📋 Copy

# IP Intelligence Briefing: 51.195.215.152/32

Classification: Moderate Risk (Score: 40/100)

Report Date: 2026-06-17

Status: Active Monitoring Required

---

## Executive Summary

IP address 51.195.215.152 is assigned to OVH cloud infrastructure with ownership linked to Ahrefs Pte Ltd Dmytro. The IP is hosted in London, GB, operating within cloud compute infrastructure. While no direct threat indicators are present, the subnet exhibits high abuse density, warranting elevated monitoring. The IP is not classified as a known attacker, spam source, or Tor exit node.

---

## Ownership & Infrastructure

Network Classification:

• Cloud infrastructure: Yes
• Hosting provider: Yes
• CDN/VPN/Proxy: No
• Tor exit node: No
• Mobile/residential: No

---

## DNS & Service Analysis

Reverse DNS: proxy-uk009-san152.ahrefs.net

Forward Resolution: Confirmed (ahrefs.net)

DNSSEC: Valid

DNSBL Status: Listed on 1 of 8 monitored lists

Services: No open ports detected. Firewall configuration prevents service enumeration.

---

## Threat Assessment

Current Risk Indicators:

• Known campaigns: None
• Blacklist count: 0
• Abuse confidence score: Not available
• Pulsedive risk: Not available
• Email authentication: SPF/DMARC not configured

Control Plane Data:

• BGP prefix: 51.195.0.0/16
• Origin ASN: 16276
• Route stability: False
• DNSBL listings: 1 of 8

---

## Neighborhood Analysis (Subnet: 51.195.215.0/24)

Assessment: The /24 subnet demonstrates significant abuse activity with 68% abuse density. This IP shares infrastructure with 174 other threat-scorning siblings, indicating potential network-level compromise or abuse patterns.

---

## Historical Signals (22 Observations)

Recent Observations:

• 2026-06-17: Operator score 0.2174 (Minimal risk), subnet abuse density 0.6797 maintained
• 2026-06-14: Geolocation signals confirmed GB/London (0.28 confidence), subnet abuse signals consistent

Temporal Analysis:

• Ownership changes: 0
• Threat observation count: 0
• Threat persistence: Not persistently malicious

---

## Recommended Actions

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 51.195.215.152 -j DROP

# nftables

nft add rule inet filter input ip saddr 51.195.215.152 drop

# nginx

deny 51.195.215.152;

# pfSense

51.195.215.152/32

```

Cloud Provider Rules:

• Cloudflare WAF: Block with filter expression `ip.src eq 51.195.215.152`
• AWS WAF: Add address 51.195.215.152/32 with description "IPDebrief risk 40"

---

## Intelligence Assessment

This IP operates within compromised cloud infrastructure. The high-abuse subnet environment (68% abuse density) with 174 threat-scorning siblings suggests either:

1. Shared hosting infrastructure with compromised neighbors

2. Potential lateral movement capability within the subnet

3. Reputational risk from adjacent IP abuse

Recommended Monitoring:

• Monitor for connection attempts to this subnet
• Review firewall logs for traffic patterns
• Consider blocking the entire /24 subnet if threat correlation exists
• Verify legitimate business use before permanent blocking

Confidence Level: Medium – No direct threat indicators present, but contextual subnet risk is significant.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.