51.222.95.151📋 Copy

# IP Intelligence Briefing: 51.222.95.151/32

Classification: MODERATE RISK | Provider: OVH SAS (Hosting)

Date: 2026-06-29

Analyst: IPDebrief SOC

---

## Executive Summary

IP address 51.222.95.151 is a moderate-risk infrastructure host registered to OVH SAS (ASN 16276) in Beauharnois, Quebec, Canada. The IP resolves to proxy-ca010-san151.ahrefs.net under the ahrefs.net domain. Recent observations indicate proxy/VPN activity, though the IP is primarily classified as cloud hosting infrastructure.

---

## Technical Profile

Ownership & Infrastructure:

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 51.222.95.0/24
• Infrastructure Type: Cloud Computing
• Classification: Hosting Provider (not CDN, Tor, VPN, or proxy)

Geolocation:

• Country: Canada (CA)
• Region: Quebec
• City: Beauharnois
• Geo Consensus: True (2 sources)

DNS Resolution:

• PTR Hostnames: proxy-ca010-san151.ahrefs.net
• Forward Hostnames: proxy-ca010-san151.ahrefs.net
• Email Auth: No SPF/DMARC records configured

---

## Risk Assessment

Overall Risk Score: 40 (Moderate Risk)

• Risk Breakdown: Provider/Authority scores at baseline
• DNSBL Status: Listed on 1 of 8 threat feeds
• Reputation Sources: Multiple feeds indicate mixed signals

Control Plane:

• BGP Prefix: 51.222.0.0/16
• Route Stability: False (route changes detected)
• DNSSEC: Valid
• RPKI State: Pending

Network Services:

• Open Ports: None detected
• TLS Certificate: Not active
• HTTP Banner: Not available
• Service Purpose: Firewalled / No Services

---

## Neighborhood Analysis

Subnet: 51.222.95.0/24

• Total Siblings: 256 IPs
• Active Siblings: 234 (91.4% utilization)
• Threat Siblings: 189 (75.6% threat ratio)
• Abuse Density: 73.83% (HIGH)
• Subnet Classification: high_abuse
• Inherited Risk Score: 29

Risk Distribution in Subnet:

• High Risk: 0
• Medium Risk: 94
• Low Risk: 6

---

## Observation History

Total Observations: 23 signals recorded

Recent Activity (2026-06-29):

• ASN: AS16276 (OVH SAS) — Risk: 66, Confidence: 85%
• Infrastructure: Cloud hosting (OVH) — Confidence: 90%
• Domain: ahrefs.net — CAA records present — Confidence: 80%
• Proxy Detection: Some signals indicate proxy activity

Temporal Indicators:

• Threat Persistence: 0 days
• Ownership Changes: 0
• Is Persistently Malicious: False
• Threat Observation Count: 1

---

## Relationship Graph

Total Relationships: 54

• Primary Network: OVH-CUST-281059689 (repeated 54 times)
• Target Types: Network infrastructure only
• No external entity links detected (certificates, hostnames, campaigns)

---

## Recommended Security Actions

SOC Analyst Guidance:

1. Monitor for Anomalies: The subnet exhibits high abuse density (73.83%). Monitor traffic patterns from this /24 for suspicious activity.

2. Review Proxy Signals: Recent observations indicate proxy/VPN activity. Evaluate if this aligns with legitimate business use cases for the organization.

3. DNSBL Monitoring: The IP is listed on 1 DNSBL. Investigate the specific blacklist and remediation requirements.

4. Email Reputation: No SPF/DMARC records configured. If this domain receives email, ensure proper authentication is implemented.

5. Cloud Infrastructure: No open ports detected. If this IP should serve traffic, investigate why services are not exposed.

Firewall Rules (Recommended):

• Allow traffic only if business justification exists
• Monitor for outbound connections from this IP
• Block if confirmed malicious activity detected

---

Conclusion: The IP represents legitimate hosting infrastructure within a high-abuse subnet. While the IP itself shows moderate risk, the surrounding neighborhood context warrants heightened monitoring. No immediate blocking required, but continued observation recommended due to proxy detection signals and high subnet abuse density.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.