51.195.244.189📋 Copy

# IP INTELLIGENCE BRIEFING: 51.195.244.189/32

## Executive Summary

The IP address 51.195.244.189/32 presents a Moderate Risk profile (Risk Score: 40/100). While not exhibiting active threat indicators, the IP is hosted on OVH cloud infrastructure in London, UK, with DNS records associated with Ahrefs Pte Ltd. The IP resides in a high-abuse-density subnet (51.195.244.0/24) with approximately 95% of active siblings classified as threats.

## Ownership & Infrastructure Classification

• ASN: AS16276 (OVH SAS)
• Organization: Ahrefs Pte Ltd Dmytro
• Registration: ARIN RIR
• Infrastructure Type: Cloud Compute (OVH hosting provider)
• Network Role: Firewalled / No Services Open
• Classification: Cloud Infrastructure, Not CDN/VPN/Proxy/Tor

## Geolocation Data

• Country: Great Britain (GB)
• Region: England (ENG)
• City: London
• Coordinates: 51.5095°N, -0.0955°W
• Timezone: Europe/London
• Geo Confidence: Multiple source consensus

## DNS Analysis

• PTR Hostname: proxy-uk000-san189.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed (1 hostname)
• Email Authentication: SPF/DMARC not configured
• DNSSEC: Valid

## Threat Indicators

• Blacklist Count: 0
• DNSBL Listings: 1 out of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None detected

## Neighborhood Assessment (51.195.244.0/24)

• Subnet Classification: High Abuse
• Abuse Density: 0.8438 (84.38%)
• Active Siblings: 227 out of 256 total
• Threat Siblings: 216 out of 227 active (95.2% threat rate)
• Inherited Risk Score: 33/100
• Risk Distribution: 51 medium, 49 low, 0 high

## Observation History

• Total Signals: 21 observations
• Latest Activity: 2026-06-20 09:23 UTC
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0
• Route Stability: False (0 route changes in 30 days)

## Recommended Security Actions

Firewall Rules

iptables:

```bash

iptables -A INPUT -s 51.195.244.189 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 51.195.244.189 drop

```

nginx:

```nginx

deny 51.195.244.189;

```

pfSense:

```

51.195.244.189/32

```

Cloudflare WAF:

```json

{

"action": "block",

"filter": {"expression": "ip.src eq 51.195.244.189"},

"description": "Block 51.195.244.189 — IPDebrief risk score 40"

}

```

AWS WAF:

```json

{

"Addresses": ["51.195.244.189/32"],

"Description": "IPDebrief risk 40"

}

```

## Analyst Notes

While this IP shows no direct threat indicators (no known campaigns, zero active blacklists), its presence in the 51.195.244.0/24 subnet warrants attention. The subnet exhibits extreme abuse concentration with 95% of active neighbors flagged as threats. The moderate risk score (40) likely reflects the subnet-level risk inheritance rather than individual IP compromise. The DNS records point to Ahrefs infrastructure, suggesting this may be a legitimate service IP or a compromised hosting account on OVH infrastructure.

Recommendation: Implement blocking rules as provided, particularly for inbound traffic. Consider subnet-level restrictions (51.195.244.0/24) if threat correlation with neighboring IPs is confirmed through additional telemetry. Monitor for any service activity emergence on this previously firewalled host.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.