51.222.95.104📋 Copy

IP Intelligence Briefing: 51.222.95.104

Date: June 14, 2026

---

**1. Core Profile**

• Risk Score: Moderate (50/100)
• Ownership:

- ISP: OVH (ASN 16276)

- Organization: Ahrefs Pte Ltd (Netname: OVH-CUST-281059689)

- Geolocation:

- Country: Canada (CA)

- Region: Quebec (QC)

- City: Singapore (inconsistent with geolocation data)

- Network Role: Hosting provider (firewalled, no public services)

---

**2. Threat Indicators**

• DNSBL Listings:

- Listed in 2/8 DNS-based blacklists (e.g., Spamhaus, OpenBL).

• No Malicious Activity:

- No detected malware, phishing, or exploit indicators.

- No known campaigns or malicious domains linked.

• Geolocation Anomalies:

- Conflicting location data (Canada vs. Singapore).

---

**3. Network Behavior**

• Subnet Analysis:

- /24 Subnet: 51.222.95.0/24

- Abuse Density: 52.4% (high risk for the subnet).

- Neighbors:

- 131/250 IPs in the subnet are flagged as malicious or suspicious.

- 181/250 IPs are active, with 73 medium-risk and 27 low-risk siblings.

• BGP/Control Plane:

- AS Path: Unavailable (RPKI/IRR data incomplete).

- Operator Score: Minimal risk (0.2174).

---

**4. Historical Observations**

• Recent Activity (Last 2 Days):

- June 14:

- Geolocation signal (CA/QC) with 3000km accuracy radius.

- DNSBL listings (2/8 blacklists).

- June 13:

- DNS records for `ahrefs.net` (CAA records, no SPF/DKIM).

- Operator score labeled "Minimal" (low risk).

• Trend: No persistent malicious behavior; risk levels remain stable.

---

**5. Relationships & Context**

• Linked Entities:

- Same Network: OVH-CUST-281059689 (ASN 16276).

- Domain: `ahrefs.net` (PTR hostname: `proxy-ca010-san104.ahrefs.net`).

• Email Security:

- No email authentication records (SPF/DKIM/DMArc).

---

**6. Recommendations**

1. Monitor Subnet:

- High abuse density in 51.222.95.0/24 warrants continuous monitoring.

2. Verify Geolocation:

- Investigate conflicting location data (Canada vs. Singapore).

3. DNS Security:

- Ensure `ahrefs.net` DNS records are configured to avoid blacklists.

4. Network Segmentation:

- Isolate this IP from critical assets due to subnet risk exposure.

Note: While the IP is not currently malicious, its association with a high-risk subnet and DNSBL listings requires vigilance.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.