51.222.168.242
IP Intelligence Dossier
Your IP: 216.73.216.123
🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.
IP Intelligence Briefing: 51.222.168.242
*Last Updated: 2026-06-15*
Risk Assessment
- Risk Score: 40 (Moderate Risk)
- Provider: OVH (ASN 16276)
- Ownership: Ahrefs Pte Ltd (OVH-CUST-281059697)
- Geolocation: Registered to Canada (CA), but geolocation data shows "Singapore" with 3000km accuracy radius.
- Network Role: CloudCompute instance (OVH infrastructure, no residential/mobile indicators).
Threat Indicators
- No direct malware, phishing, or exploit indicators.
- Subnet abuse density: 64.45% (high_abuse classification).
- 165 threat siblings in the 51.222.168.0/24 subnet.
- Inherited risk: 25 (likely from subnet-level abuse).
Neighbor Analysis
- 256 IPs in subnet (51.222.168.0/24), with 210 active and 165 flagged as threats.
- Top Risk Distribution: 97 IPs (medium risk), 3 IPs (low risk).
Relationships
- Linked to OVH-CUST-281059697 network.
- DNS: Resolves to `proxy-ca018-san242.ahrefs.net` (ahrefs.net domain).
- No TLS certificates or open ports detected.
Behavioral & Network Data
- BGP: Route stability unknown; 0 route changes in 30 days.
- DNS: DNSSEC invalid, no CAA records, and no DNSBL listings.
- Historical Signals: Minimal risk (0.1 operator score) with no persistent malicious activity.
Recommended Actions
- Monitor subnet: High abuse density suggests potential for lateral movement or related threats.
- Block IP: Implement firewall rules (see below) to restrict traffic.
- Investigate geolocation discrepancy: Verify if the IP is misregistered or spoofed.
Firewall Rules
```bash
iptables -A INPUT -s 51.222.168.242 -j DROP
nft add rule inet filter input ip saddr 51.222.168.242 drop
```
*Cloud/WAF integrations available via IPDebrief actions.*
Conclusion
This IP is part of a high-abuse subnet with no direct malicious indicators but warrants monitoring due to its association with risky neighbors. Verify ownership and geolocation anomalies, and consider blocking to mitigate potential exposure.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Dmytro, Ahrefs Pte Ltd |
| ASN | AS16276 |
| Network Name | OVH-CUST-281059697 |
| CIDR Block | 51.222.168.0/24 |
| RIR | ARIN |
| Country | Singapore |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | proxy-ca018-san242.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-ca018-san242.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
No certificate
Issued by —
N/A
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 40% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 15% | 2 | 2 |
| ownership | 15% | 2 | 2 |
| reputation | 23% | 1 | 2 |
| geolocation | 40% | 2 | 3 |
| Overall | 24% | 10 | 13 |
Coverage: 6/6 dimensions · Data sufficiency: sufficient
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
⚠ Claimed geolocation contradicts RTT physics measurement
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-24 00:33:07 UTC |
| Last Seen | 2026-06-28 23:27:49 UTC |
| Profile Built | 2026-06-29 05:30:15 UTC |
| Data Freshness | Live |
| Signal Types | 19 |
| Total Observations | 20 |
🔍 19 signal types · 20 observations collected
This report is generated from 19+ independent intelligence signals including
ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds,
behavioral fingerprinting, and more.
Full dossier details are available via our API.
Full dossier details are available via our API.
ℹ️ About This Report
All data shown is publicly available network metadata — IP addresses do not reliably identify individuals.
Assessments are probabilistic and should not be used as sole basis for access control decisions.
To report an issue or request data review, contact admin@ipdebrief.com.