51.222.95.143📋 Copy

# IP Intelligence Briefing: 51.222.95.143

## Executive Summary

IP 51.222.95.143 presents a Moderate Risk profile (Risk Score: 40) within a high-abuse subnet environment. The address is hosted on OVH cloud infrastructure under the organization "Dmytro, Ahrefs Pte Ltd" and resolves to the ahrefs.net domain. Despite a risk score of 40, the subnet exhibits concerning abuse density metrics (0.7188), with 184 of 256 sibling IPs classified as threats.

## Ownership and Infrastructure

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network: OVH-CUST-281059689 (51.222.95.0/24)
• Infrastructure Type: CloudCompute/Hosting
• Classification: Cloud hosting environment with firewall protection (no open services detected)

## Geolocation Analysis

The IP reports conflicting geolocation data:

• Reported Country: Canada (CA)
• Reported Region: Quebec (QC)
• Reported City: Singapore
• DNS Resolution: proxy-ca010-san143.ahrefs.net

This geolocation inconsistency warrants monitoring, as the hostname suggests Singapore while geolocation services report Canada.

## Neighborhood Risk Assessment

The /24 subnet demonstrates elevated abuse characteristics:

• Abuse Density: 0.7188 (71.88% - High Risk)
• Subnet Classification: high_abuse
• Threat Siblings: 184 out of 256 total IPs
• Active Siblings: 234 out of 256 total IPs
• Inherited Risk Score: 28

All neighboring IPs within the subnet exhibit risk scores between 40-50, indicating a consistently elevated risk environment.

## Threat Indicators

• Blacklist Count: 0
• DNSBL Listed: 1 of 8 total lists
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Correlation: None detected
• Historical Threat Observations: 1

## Observation History

21 historical observations recorded. Key timeline events:

• 2026-06-28: Latest operator score assessment (0.1)
• 2026-06-20: Subnet abuse density confirmation (0.7188) and network classification (OVH hosting)

The IP shows no persistent malicious behavior but maintains consistent classification within the high-abuse subnet.

## Network Role and Services

• Open Ports: None detected (firewalled)
• CDN: No
• VPN/Proxy: No
• Mobile/Residential: No
• Bogon: No
• Anycast: No

## Recommended Security Actions

Based on the risk profile and neighborhood context, the following firewall rules are recommended:

iptables:

```bash

iptables -A INPUT -s 51.222.95.143 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 51.222.95.143 drop

```

nginx:

```nginx

deny 51.222.95.143;

```

AWS WAF:

```json

{

"Addresses": ["51.222.95.143/32"],

"Description": "IPDebrief risk 40"

}

```

## Intelligence Assessment

This IP should be monitored or blocked depending on organizational policy. While the individual IP score of 40 suggests moderate risk, the subnet-level abuse density (0.7188) and high number of threat siblings (184) indicate the entire 51.222.95.0/24 network warrants broader scrutiny. The geolocation discrepancy between reported Canada and Singapore-based hostname should be noted for potential reputation validation.

Recommendation: Implement network-level blocking for the 51.222.95.0/24 subnet or at minimum monitor traffic from 51.222.95.143 with enhanced logging.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.