51.222.95.228📋 Copy

# IP Intelligence Briefing: 51.222.95.228/32

## Executive Summary

IP 51.222.95.228 presents moderate risk (score: 40) from OVH cloud infrastructure with significant neighborhood-level abuse indicators. While the IP shows no direct threat indicators, the subnet (51.222.95.0/24) exhibits high abuse density (0.7188) with 184 of 256 total siblings flagged as threats.

## Threat Profile

Risk Assessment

• Risk Score: 40/100 (Moderate Risk)
• Classification: High Abuse Subnet
• Network Role: Cloud Compute (OVH) – Firewalled / No Services Open
• ASN: AS16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd

Geolocation Anomalies

Critical geolocation inconsistencies detected:

• Claimed Location: Quebec, Canada (45.4995, -73.5848)
• Reported City: Singapore
• Distance Discrepancy: 5,598 km reported distance with RTT 29ms, but minimum possible RTT should be 112ms for this distance
• RTT Violation: Observed RTT 29ms < minimum possible 112ms for 5,598 km
• Validation Status: Geo-plausible: FALSE

This suggests potential geo-spoofing or misconfigured infrastructure.

DNS Analysis

• PTR Hostname: proxy-ca010-san228.ahrefs.net
• Forward Resolution: proxy-ca010-san228.ahrefs.net
• Domain: ahrefs.net
• Email Authentication: No SPF/DMARC records configured
• DNSBL Listed: 1 of 8 total lists

Neighborhood Context (51.222.95.0/24)

• Abuse Density: 0.7188 (High Abuse)
• Active Siblings: 232 of 256 total IPs
• Threat Siblings: 184 flagged as threats
• Inherited Risk: 28/100
• Risk Distribution: 100 medium-risk neighbors, 0 high/low-risk

## Historical Activity

25 observations recorded with recent activity on 2026-06-20. Threat signals detected from AlienVault OTX pulse. No persistent malicious behavior identified over time.

## Related Infrastructure

• Network: OVH-CUST-281059689
• Related Entities: 46 relationships (primarily same-network associations)
• Campaign Affiliation: None identified

## Recommended Actions

Immediate Firewall Rules

```bash

# iptables

iptables -A INPUT -s 51.222.95.228 -j DROP

# nftables

nft add rule inet filter input ip saddr 51.222.95.228 drop

# nginx

deny 51.222.95.228;

```

Cloud Provider Recommendations

• Cloudflare WAF: Block IP 51.222.95.228 with risk score 40
• AWS WAF: Add 51.222.95.228/32 to block list
• pfSense: Apply rule for 51.222.95.228/32

## Analyst Notes

1. Subnet-Level Action: Consider blocking the entire /24 subnet (51.222.95.0/24) given 71.88% abuse density and 184 threat-adjacent IPs.

2. Geolocation Verification: The RTT/geolocation mismatch warrants investigation for potential spoofing or infrastructure misconfiguration.

3. DNS Risk: Forward resolution points to Ahrefs infrastructure without proper email authentication (no SPF/DMARC).

4. No Open Services: IP appears to be a headless/proxy endpoint with no active services, reducing direct exploitation risk but maintaining neighborhood-level threat relevance.

## Risk Conclusion

While the IP itself shows no active malicious indicators, the subnet-level abuse density and geolocation inconsistencies warrant defensive blocking. Monitor for lateral activity patterns across the 51.222.95.0/24 range.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.