51.222.95.158📋 Copy

INTELLIGENCE BRIEFING: 51.222.95.158/32

Executive Summary

IP address 51.222.95.158 resolved to hostname proxy-ca010-san158.ahrefs.net under ASN 16276 (OVH). The endpoint carries a moderate risk score of 40 with no active threat indicators. However, geolocation validation failed, subnet abuse density remains high at 0.7266, and 186 of 256 siblings in the /24 block were classified as threats.

Ownership and Network Classification

The IP belongs to OVH-CUST-281059689 within the 51.222.95.0/24 CIDR block. Organization registration shows Dmytro, Ahrefs Pte Ltd. Network role classification indicates hosting infrastructure with no open ports or services detected. The endpoint is associated with the ahrefs.net domain, resolving to proxy-ca010-san158.ahrefs.net. DNSSEC validation passed; RPKI state and IRR consistency remain unverified.

Geolocation Anomalies

Geolocation data reported Canada (QC) with claimed Singapore coordinates at 3,000 km accuracy radius. RTT measurements (27-33ms) violated physical distance constraints—minimum expected RTT for 5,598 km distance was 112ms. This discrepancy indicates either spoofed geolocation data or significant routing anomalies.

Threat Indicators and Reputation

Abuse confidence score returned null. Blacklist enumeration showed 0 matches across threat feeds. DNSBL listing recorded 1 of 8 total lists. No Tor exit node activity detected. Known attacker flags, spam source indicators, and campaign affiliations all registered negative.

Subnet Neighborhood Analysis

The 51.222.95.0/24 subnet demonstrated high abuse classification with abuse density of 0.7266. Of 256 total sibling addresses, 232 remained active with 186 threat siblings. Inherited risk score of 29 reflects subnet-level contamination. Neighbor risk scores uniformly rated at 40 with authority scores of 50.

Observation History

Historical tracking captured 23 signal observations. The most recent observation (2026-06-18) confirmed subnet abuse density at 0.7266. Ownership changes registered at zero with no persistent malicious threat patterns identified.

Recommended Actions

No specific firewall rules or security actions generated by automated analysis. The IP presents moderate risk primarily through geolocation inconsistencies and subnet-level abuse density rather than direct threat indicators.

Assessment

The endpoint exhibits characteristics of compromised or misconfigured infrastructure within a hosting environment. While no direct attack indicators were observed, the high abuse density of the parent subnet and geolocation validation failures warrant monitoring. No immediate blocking recommended; implement enhanced monitoring for this IP and adjacent subnet addresses.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.