51.222.168.240📋 Copy

IP INTELLIGENCE BRIEFING: 51.222.168.240/32

OVERVIEW

IP 51.222.168.240 carries a moderate risk score of 40 and is assigned to OVH SAS (ASN 16276) under organization Dmytro, Ahrefs Pte Ltd. The subnet 51.222.168.0/24 is classified as high abuse with an abuse density of 0.8086, containing 207 threat siblings among 222 active addresses.

OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH SAS)
• CIDR Block: 51.222.168.0/24
• Infrastructure Type: CloudCompute (OVH hosting infrastructure)
• Network Role: Firewall/no services detected
• Classification: Not bogon, not proxy, not Tor

GEOLOCATION VIOLATIONS

Significant geolocation inconsistencies detected:

• Listed Location: Canada (CA), Quebec (QC)
• Reported City: Singapore
• Distance Discrepancy: 5,598 km with RTT of 27ms
• Minimum Possible RTT: 112ms for this distance
• Assessment: Geolocation data is implausible; indicates misconfiguration or spoofing

THREAT PROFILE

• Risk Score: 40 (Moderate Risk)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0 direct blacklists
• DNSBL Listed: 1 of 8 total lists
• Abuse Confidence Score: Not available

DNS ANALYSIS

• PTR Hostname: proxy-ca018-san240.ahrefs.net
• Forward Resolution: proxy-ca018-san240.ahrefs.net
• Domain: ahrefs.net
• Forward Confirmation: False
• Email Auth: No SPF or DMARC records configured

NEIGHBORHOOD ANALYSIS

The 51.222.168.0/24 subnet exhibits elevated abuse characteristics:

• Abuse Density: 0.8086 (high)
• Risk Distribution: 100 medium-risk neighbors, 0 high-risk
• Total Siblings: 256
• Active Siblings: 222
• Threat Siblings: 207
• Inherited Risk Score: 32

OBSERVATION HISTORY

• 19 total observations recorded
• Most recent signals (2026-06-15): High abuse classification, OVH ASN attribution, operator score 0.2174 (minimal)
• Ownership stability: No ownership changes detected
• Threat persistence: 1 observation, not persistently malicious

RECOMMENDED ACTIONS

Firewall blocking rules recommended across multiple platforms:

• iptables: `iptables -A INPUT -s 51.222.168.240 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 51.222.168.240 drop`
• nginx: `deny 51.222.168.240;`
• pfSense: 51.222.168.240/32
• Cloudflare WAF: Block with expression `ip.src eq 51.222.168.240`
• AWS WAF: Add 51.222.168.240/32 to IPSet

ANALYST NOTES

The IP resides in a high-abuse OVH subnet with significant neighborhood risk. While the specific address shows no direct threat indicators, the geolocation violations and DNSBL listing warrant investigation. The PTR hostname suggests legitimate use (Ahrefs service), but the subnet abuse density indicates broader infrastructure risks. Consider blocking at perimeter firewalls and monitoring for associated activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.