51.222.168.36📋 Copy

## IP INTELLIGENCE BRIEFING: 51.222.168.36/32

Classification: MODERATE RISK | Last Updated: 2026-06-20

---

EXECUTIVE SUMMARY

IP 51.222.168.36 is a moderate-risk (score: 40) OVH hosting infrastructure endpoint associated with Ahrefs Pte Ltd. While the IP itself shows no direct threat indicators, it operates within a high-abuse subnet (51.222.168.0/24) with a 72.27% abuse density rating, requiring elevated monitoring.

---

OWNERSHIP & NETWORK CLASSIFICATION

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 51.222.168.0/24
• Network Name: OVH-CUST-281059697
• Infrastructure Type: CloudCompute (OVH)
• RIR: ARIN

---

GEOLOCATION ANALYSIS

• Primary Location: Singapore (latitude/longitude: null)
• Secondary Location: Canada (QC)
• Accuracy Radius: 3,000 km
• GeoConsensus: Active (2 sources)
• Note: Geographic data inconsistency detected (Singapore vs Canada) — common in CDN/cloud hosting environments

---

THREAT INDICATORS

• Blacklist Count: 0
• Abuse Confidence: Not scored
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None
• Threat Feeds: None
• DNSBL Listed: 1 of 8 total lists

---

DNS & SERVICE PROFILE

• PTR Hostnames: proxy-ca018-san36.ahrefs.net
• Reverse DNS: Confirmed (1 forward resolution)
• Open Ports: None detected
• HTTP Services: None detected
• TLS Certificates: None
• Email Auth (SPF/DMARC): Not configured

---

SUBNET NEIGHBORHOOD ANALYSIS

• Subnet: 51.222.168.0/24
• Abuse Density: 0.7227 (HIGH)
• Classification: HIGH_ABUSE
• Total Siblings: 256
• Active Siblings: 222 (86.7%)
• Threat Siblings: 185 (74.3%)
• Inherited Risk Score: 28

Key Finding: The subnet exhibits elevated abuse activity with 74.3% of active IPs flagged as threats. This contextual risk elevates the monitoring priority for this endpoint.

---

OBSERVATION HISTORY

• Total Observations: 23 signals
• Latest Observation: 2026-06-20T12:16:09 UTC
• Historical Provider: OVH (consistent)
• Abuse Density Trend: Stable at 0.7227 across observation period
• Threat Persistence: 0 days
• Is Persistently Malicious: No

---

RELATIONSHIP GRAPH

• Total Relationships: 45
• Primary Association: OVH-CUST-281059697 (Same Network)
• Related Entities: 40+ network-level relationships

---

SECURITY ACTIONS & RECOMMENDATIONS

No specific blocking actions recommended for this IP based on current risk profile. However, the following monitoring advisories apply:

1. Elevated Monitoring: Due to high-abuse subnet classification (72.27% abuse density), implement enhanced logging and alerting for this endpoint.

2. Traffic Pattern Analysis: Monitor for deviations from normal Ahrefs proxy traffic patterns.

3. Geolocation Consistency: Investigate Singapore vs Canada geolocation discrepancy for potential spoofing indicators.

4. Subnet-Wide Assessment: Consider evaluating adjacent IPs in 51.222.168.0/24 for correlated malicious activity.

---

CONCLUSION

IP 51.222.168.36 is a legitimate OVH hosting endpoint for Ahrefs services with no direct threat indicators. However, its placement within a high-abuse subnet (51.222.168.0/24) necessitates continued monitoring. The IP should be allowed with enhanced logging, but security teams should remain vigilant for anomalous traffic patterns that may indicate compromise or abuse of the hosting infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.