51.222.95.154📋 Copy

# INTELLIGENCE BRIEFING: 51.222.95.154/32

## EXECUTIVE SUMMARY

IP 51.222.95.154 is a cloud compute endpoint hosted on OVH infrastructure with a moderate risk score of 40. The IP resolves to Ahrefs-related domains and exhibits geographic inconsistencies. While no active threat indicators are present, the parent subnet (51.222.95.0/24) demonstrates high abuse density with 141 identified threat siblings.

---

## OWNERSHIP & INFRASTRUCTURE

• Network Provider: OVH (ASN 16276)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 51.222.95.0/24
• Infrastructure Type: Cloud Compute / Hosting
• DNS PTR Hostnames: proxy-ca010-san154.ahrefs.net
• Forward Resolution: proxy-ca010-san154.ahrefs.net

## GEOLOCATION ANALYSIS

• Reported Location: Canada (QC) / Singapore
• Geographic Validation: INVALID

- Measured Distance: 5,597.9 km

- Minimum Possible RTT: 112.0 ms

- Observed RTT: 27.0 ms

- VIOLATION: RTT 27.0ms < minimum possible 112.0ms for 5598km distance

• Control Plane: BGP prefix 51.222.0.0/16, route stability flags indicate false

## THREAT INDICATORS

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence Score: Not calculated
• Known Attacker: False
• Spam Source: False
• Tor Exit: False
• Blacklist Count: 0
• DNSBL Listings: 1 of 8 total lists
• Known Campaigns: None detected
• Threat Persistence: 0 days

## NETWORK BEHAVIOR

• Service Status: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• Infrastructure Classification: Cloud hosting environment

## SUBNET ANALYSIS (51.222.95.0/24)

• Total Siblings: 256
• Active Siblings: 237
• Threat Siblings: 141
• Abuse Density: 0.5508 (High Abuse Classification)
• Inherited Risk: 22
• Neighbor Risk Distribution: 100 medium-risk IPs (0 high, 0 low)
• Sample Neighbor Risk Scores: 40-50 range across subnet

## OBSERVATION HISTORY

• Total Observations: 23
• Recent Activity: DNS resolution signals (ahrefs.net), geolocation probes
• Threat Observation Count: 1
• Is Persistently Malicious: False

## RELATIONSHIP GRAPH

• Total Relationships: 66
• Primary Associations: Multiple "Same Network" relationships to OVH-CUST-281059689
• No correlated campaign IPs or certificates identified

---

## RECOMMENDED ACTIONS

Firewall Rules (Block)

iptables:

```

iptables -A INPUT -s 51.222.95.154 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 51.222.95.154 drop

```

nginx:

```

deny 51.222.95.154;

```

pfSense:

```

51.222.95.154/32

```

Cloudflare WAF:

```json

{

"description": "Block 51.222.95.154 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 51.222.95.154"

}

}

```

AWS WAF:

```json

{

"Addresses": ["51.222.95.154/32"],

"Description": "IPDebrief risk 40"

}

```

---

## ANALYST NOTES

1. Geographic Inconsistency: The IP's reported location shows significant validation errors. This may indicate misconfigured DNS or spoofed geolocation data.

2. Subnet Context: The parent /24 subnet shows elevated abuse density (141 threat siblings). Consider evaluating additional IPs in the 51.222.95.0/24 range for similar patterns.

3. Ahrefs Association: DNS resolution to ahrefs.net suggests the IP may be part of web infrastructure for Ahrefs services. Legitimate traffic from this network should be expected in normal operations.

4. No Active Threats: Current profile shows no active threat indicators or campaign associations. Blocking recommendation is based on moderate risk score and subnet abuse density rather than confirmed malicious activity.

5. Recommendation: Implement monitoring rather than immediate blocking. The moderate risk score (40) combined with the subnet's abuse density warrants continued observation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.