51.195.215.36📋 Copy

# IP INTELLIGENCE BRIEFING: 51.195.215.36/32

## Executive Summary

IP 51.195.215.36 is a moderate-risk (40/100) cloud infrastructure address hosted on OVH in London, GB. The IP resolves to a known Ahrefs domain (proxy-uk009-san36.ahrefs.net) but operates within a high-abuse-density subnet (0.8086) containing 207 threat-adjacent neighbors. No active threat indicators or malicious campaigns observed.

## Ownership & Infrastructure

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH SAS)
• Location: London, England, GB (RIR: ARIN)
• Infrastructure Type: Cloud compute, hosting provider
• Network Role: Cloud infrastructure with no active services detected

## DNS Analysis

• PTR Record: proxy-uk009-san36.ahrefs.net
• Forward Resolution: Confirmed to ahrs.net domain
• Email Authentication: No SPF/DMARC records configured
• DNSSEC: Valid
• CAA Records: Present

## Threat Assessment

Risk Score: 40 (Moderate Risk)

Threat Indicators:

• No blacklist entries
• Not a Tor exit node
• Not identified as a known attacker
• No spam source indicators
• No associated threat campaigns

Control Plane:

• Operator Score: 0.2174 (Minimal)
• Route stability: Unstable
• DNSBL listings: 1 of 8 total lists

## Neighborhood Analysis

Subnet: 51.195.215.0/24

• Abuse Density: 0.8086 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 211
• Threat Siblings: 207
• Risk Distribution: 100 medium-risk neighbors, 0 high/low risk

The subnet exhibits elevated abuse activity, characteristic of shared cloud hosting infrastructure.

## Observation History

Total Observations: 21 signals

• Risk Profile: Consistent moderate-risk classification
• Ownership Changes: 0 (stable)
• Threat Persistence: 0 days (not persistently malicious)
• Recent Activity: Signals observed within June 2026 timeframe

No significant risk escalation detected over observation period.

## Recommended Actions

Risk-Based Blocking Recommended:

• iptables: `iptables -A INPUT -s 51.195.215.36 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 51.195.215.36 drop`
• nginx: `deny 51.195.215.36;`
• Cloudflare WAF: Block with description "IPDebrief risk score 40"
• AWS WAF: Address block 51.195.215.36/32

Context for Decision: While the IP resolves to legitimate Ahrefs infrastructure, the high-abuse-density neighborhood warrants defensive blocking. Correlate with other traffic patterns before implementing firewall rules.

## Intelligence Narrative

The IP represents legitimate cloud hosting infrastructure operated by Ahrefs Pte Ltd within OVH's London datacenter. The address maintains stable ownership and resolves to known corporate DNS records. However, the parent subnet (51.195.215.0/24) demonstrates significant abuse density (0.8086) with 80.6% of active addresses flagged as threat-adjacent. This pattern is typical of shared hosting environments where legitimate services coexist with compromised infrastructure.

The IP shows no direct malicious indicators but inherits neighborhood risk through proximity to threat-adjacent addresses. Defense-in-depth recommendations suggest blocking at perimeter layers while maintaining awareness that the underlying infrastructure serves legitimate business purposes.

---

*Report generated from IPDebrief intelligence platform. All data sourced from IPDebrief observation and analysis systems.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.