51.222.95.21📋 Copy

IP Intelligence Briefing: 51.222.95.21

Date: 2026-06-18

---

**1. Profile Summary**

• Risk Score: 40 (Moderate Risk)
• Ownership: Owned by OVH-CUST-281059689 (Dmytro, Ahrefs Pte Ltd).
• Geolocation:

- Country: Canada (CA)

- Region: Quebec (QC)

- City: Singapore (inconsistent with regional data; potential spoofing or misconfiguration).

• Network Role: CloudCompute infrastructure (OVH-hosted, no open services).
• Threat Indicators: No direct malicious activity detected (no abuse confidence, no blacklists, no campaigns).
• DNS:

- PTR hostname: `proxy-ca010-san21.ahrefs.net` (linked to Ahrefs, a legitimate SEO company).

- No email auth records (SPF, DMARC).

---

**2. Observation History**

• Recent Activity (2026-06-14 to 2026-06-18):

- High Abuse Density: Subnet `51.222.95.21/24` has 0.6875 abuse density, with 176 threat siblings (176 IPs in the subnet flagged as malicious).

- Signal Consistency: Mixed results (minimal risk scores, but some DNS and routing anomalies).

- Geolocation Discrepancy: IP reported as "Singapore" but geolocated to Canada (QC).

---

**3. Relationships**

• Network Affiliation:

- Part of OVH-CUST-281059689 (ASN 16276).

- Subnet `51.222.95.0/24` linked to high_abuse classification.

• Linked Entities:

- Ahrefs Pte Ltd (parent organization).

- No direct ties to known malicious campaigns or domains.

---

**4. Neighborhood Analysis**

• Subnet: `51.222.95.21/24` (256 IPs total).
• Risk Distribution:

- High Risk: 0 IPs

- Medium Risk: 85 IPs

- Low Risk: 15 IPs

• Threat Siblings: 176 IPs in subnet flagged as malicious.
• Abuse Density: 68.75% of subnet IPs are associated with abuse or malicious activity.

---

**5. Actionable Intelligence**

• SOC Recommendation:

- Monitor Subnet: The `51.222.95.0/24` subnet has a high abuse density. Investigate if this IP is part of a larger malicious infrastructure.

- Verify Geolocation: Discrepancy between reported "Singapore" and Canada (QC) may indicate spoofing or misconfigured DNS.

- Check Ahrefs Compliance: Confirm if Ahrefs Pte Ltd has policies to mitigate abuse in their OVH-hosted infrastructure.

- Block Subnet (if justified): If further threats are detected in the subnet, consider blocking traffic from `51.222.95.0/24` to prevent potential lateral movement.

---

Conclusion:

This IP is part of a high-risk subnet managed by OVH for Ahrefs Pte Ltd. While no direct malicious activity is detected, the subnet’s abuse density and geolocation inconsistencies warrant close monitoring. SOC teams should prioritize validating the IP’s legitimacy and assessing the subnet’s overall risk posture.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.