51.222.95.117📋 Copy

## IP Intelligence Briefing: 51.222.95.117/32

Classification: Moderate Risk

Date: Current

Executive Summary

IP 51.222.95.117 is a cloud infrastructure endpoint within OVH's hosting network (ASN 16276), associated with Ahrefs Pte Ltd. The address operates within a high-abuse subnet (51.222.95.0/24) with an abuse density of 0.7344. While the endpoint itself shows no active services and is currently firewalled, the subnet context warrants defensive monitoring.

Profile Details

• Risk Score: 40 (Moderate Risk)
• Provider: OVH (CloudCompute infrastructure)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 51.222.95.0/24
• Infrastructure Type: Cloud Hosting
• Status: No open ports detected (Firewalled/No Services)

Geolocation Analysis

Location data presents inconsistencies: geolocation databases report the address as located in Singapore with a country code discrepancy (CA/Canada), with accuracy radius of 3,000 km. This incongruence between the Singapore city designation and Canadian country code code suggests potential data quality issues in geolocation sources.

DNS and Hostname Intelligence

The reverse DNS pointer resolves to proxy-ca010-san117.ahrefs.net, confirming association with Ahrefs infrastructure. Forward resolution confirms the ahrefs.net domain. No email authentication records (SPF/DMARC) are configured for the associated domain.

Threat Indicators

• Threat Classification: No active threat indicators (not known attacker, not Tor exit, not spam source)
• Blacklist Status: 1 of 8 DNSBL listings detected
• Operator Score: 0.2174 (Minimal)
• Campaign Correlation: No known campaigns matched

Neighborhood Analysis (51.222.95.0/24)

The /24 subnet exhibits elevated abuse activity:

• Abuse Density: 0.7344 (High Abuse classification)
• Total Siblings: 256
• Active Siblings: 234
• Threat Siblings: 188
• Risk Distribution: Neighbor scan of 100 samples shows all medium-risk ratings (score range 40-50)
• Inherited Risk: 29

The high concentration of threat siblings (73% of active siblings) within the subnet indicates systemic abuse patterns in this hosting block.

Historical Observations

19 observations recorded. Subnet abuse density classification has remained consistently "high_abuse" across all observations. Ownership has shown 0 changes, indicating stable infrastructure assignment.

Recommended Actions

Given the moderate risk profile and high-abuse neighborhood context, the following defensive measures are recommended:

Firewall/Network Rules:

• `iptables -A INPUT -s 51.222.95.117 -j DROP`
• `nft add rule inet filter input ip saddr 51.222.95.117 drop`
• `nginx: deny 51.222.95.117;`

Cloud/CDN Protection:

• Cloudflare WAF: Block with expression `ip.src eq 51.222.95.117`
• AWS WAF: Add 51.222.95.117/32 to deny list

Analyst Notes

While the individual IP shows no active malicious services, the subnet-level abuse density of 0.7344 and 188 threat siblings suggest this IP may be associated with compromised infrastructure. The Ahrefs hostname association indicates the address may be part of legitimate search engine optimization infrastructure that has been repurposed. Monitoring is recommended for any service activation on this endpoint.

---

*Intel generated via IPDebrief. Recommendations are probabilistic and should be validated against additional threat intelligence before enforcement.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.