51.222.95.112📋 Copy

## THREAT INTELLIGENCE BRIEFING

IP Address: 51.222.95.112/32

Date: Intelligence Summary

Risk Level: MODERATE (Score: 40/100)

---

EXECUTIVE SUMMARY

IP 51.222.95.112 operates within OVH cloud infrastructure (ASN 16276) as a hosting service under customer identifier OVH-CUST-281059689. The address resolves to Ahrefs.net domain infrastructure with proxy hostname proxy-ca010-san112.ahrefs.net. Current risk assessment indicates moderate threat posture with no active threat indicators detected.

NETWORK CLASSIFICATION

• Provider: OVH SAS (CloudCompute/Hosting)
• Infrastructure Type: Cloud Computing
• Service Status: Firewalled / No Services Detected
• Geolocation: Canada (CA) - QC region; geolocation validation flagged with RTT anomaly (27ms observed vs 112ms minimum expected for 5598km distance)
• CIDR Block: 51.222.95.0/24

THREAT ASSESSMENT

Current Risk Score: 40/100 (Moderate)

• Abuse Confidence: Not scored
• Blacklist Status: 0/0 lists
• DNSBL Status: Listed on 1 of 8 total DNSBLs
• Known Campaigns: None
• Threat Indicators: None detected
• Tor/VPN/Proxy: Negative for all

Historical Analysis: 23 observations recorded over monitoring period. Infrastructure classification remained stable as OVH cloud hosting. No persistent malicious activity detected.

NEIGHBORHOOD ANALYSIS

Subnet: 51.222.95.0/24

• Abuse Density: 0.7383 (HIGH)
• Classification: High Abuse
• Total Subnet IPs: 256
• Active IPs: 234
• Threat-Classified IPs: 189
• Risk Distribution: 100 medium-risk, 0 high/low-risk

The subnet exhibits elevated abuse density with significant threat concentration across sibling addresses.

RELATIONSHIP MAPPING

40 relationships identified, all mapping to same network identifier (OVH-CUST-281059689). No associations detected with:

• External organizations
• Alternative hostnames
• SSL certificates
• Compromised infrastructure

RECOMMENDED ACTIONS

Based on risk profile, the following firewall rules are recommended:

Immediate Blocking (if required):

```bash

iptables -A INPUT -s 51.222.95.112 -j DROP

nft add rule inet filter input ip saddr 51.222.95.112 drop

```

WAF Integration:

• Cloudflare WAF: Block with description "IPDebrief risk score 40"
• AWS WAF: Add address 51.222.95.112/32 to block list

Operational Note: Given the subnet's high abuse density (0.7383), consider evaluating the entire /24 subnet for broader threat correlation if operational requirements permit.

---

Intelligence Status: ACTIVE MONITORING

Classification: SOC-APPRECIABLE

Source: IPDebrief Threat Intelligence

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.