51.222.95.204📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Subject: 51.222.95.204/32

Classification: Moderate Risk – Cloud Infrastructure

Date: 2026-06-20

---

## EXECUTIVE SUMMARY

IP 51.222.95.204 is a cloud compute endpoint associated with OVH SAS (ASN 16276) under the organization Dmytro, Ahrefs Pte Ltd. The address exhibits moderate risk characteristics (score: 40) with no active threat indicators but operates within a high-abuse density subnet (51.222.95.0/24). Recommended action: Monitor or block based on context.

---

## INFRASTRUCTURE PROFILE

• IP: 51.222.95.204
• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH SAS)
• CIDR Block: 51.222.95.0/24
• Network Type: Cloud Compute (OVH hosting infrastructure)
• Service Status: Firewall/no services detected on this IP
• Reverse DNS: proxy-ca010-san204.ahrefs.net
• Forward Resolution: Not confirmed

---

## THREAT ASSESSMENT

---

## GEOLOCATION DISCREPANCY

⚠️ ANOMALY DETECTED: Geolocation data shows conflicting indicators.

• Reported Country: Canada (CA)
• Reported City: Singapore
• Distance Violation: 5,598 km reported distance with 26ms RTT (minimum expected: 112ms)
• Assessment: RTT measurement indicates geolocation spoofing or data inconsistency. Source validation recommended.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 51.222.95.0/24

• Abuse Density: 0.7383 (High abuse classification)
• Total Siblings: 256
• Active Siblings: 234
• Threat Siblings: 189
• Inherited Risk: 29

Neighborhood exhibits elevated abuse activity with 189 of 256 IPs flagged as threats. This IP inherits moderate risk from subnet context.

---

## OBSERVATION HISTORY

• Total Observations: 23 signals
• Recent Activity: 2026-06-20
• Signal Types: DNS resolution, ASN attribution, operator score, profile assessment
• Persistence: No persistent malicious behavior detected

---

## RELATIONSHIP GRAPH

• Total Relationships: 45
• Primary Associations: Same Network (OVH-CUST-281059689)
• Network Stability: Route stable, BGP prefix 51.222.0.0/16

---

## RECOMMENDED ACTIONS

Risk Score: 40 – Context-dependent blocking advised.

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 51.222.95.204 -j DROP

# nftables

nft add rule inet filter input ip saddr 51.222.95.204 drop

# nginx

deny 51.222.95.204;

# AWS WAF

Addresses: ["51.222.95.204/32"]

Description: IPDebrief risk 40

```

SOC Guidance:

• Block if this IP appears in malicious activity context
• Monitor for lateral movement within the /24 subnet
• No immediate threat indicators present
• Consider geolocation discrepancy in incident correlation

---

## INTELLIGENCE NOTES

This IP operates within OVH's cloud infrastructure, specifically associated with Ahrefs services. The high neighborhood abuse density suggests potential for compromised or misconfigured endpoints in the subnet. The geolocation anomaly warrants inclusion in geolocation validation workflows. No active malicious campaigns or known attacker signatures detected.

Confidence Level: Medium (based on historical signals and network classification)

Last Updated: 2026-06-20

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.