51.222.95.26📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 51.222.95.26/32

Classification: Moderate Risk / High Abuse Environment

Date: 2026-06-19

---

## EXECUTIVE SUMMARY

IP 51.222.95.26 is a cloud infrastructure endpoint operated by OVH under customer OVH-CUST-281059689. The IP is associated with the domain ahrefs.net and exhibits moderate risk characteristics (Risk Score: 40) within a high-abuse subnet environment. Despite no directly observed malicious indicators, the IP resides in a /24 subnet with 70.7% abuse density and 181 active threat siblings.

---

## OWNERSHIP & INFRASTRUCTURE

Organization: Dmytro, Ahrefs Pte Ltd

ASN: 16276 (OVH SAS)

Network Block: 51.222.95.0/24

Infrastructure Type: Cloud Compute (OVH hosting)

DNS Resolution: proxy-ca010-san26.ahrefs.net

The endpoint is configured with firewalling enabled (no open ports detected). Route stability is compromised, with control plane data indicating non-stable routing characteristics.

---

## GEOLOCATION DISCREPANCY

Reported Location: Canada (QC) / Singapore (inconsistent)

Confidence: 0.35 (Low-Moderate)

Accuracy Radius: 3000km

Significant geolocation inconsistency detected between Canadian and Singaporean sources. This discrepancy warrants validation when correlating with threat intelligence, as it may indicate misreported origin data or multi-location routing.

---

## THREAT INDICATORS

Direct Threat Indicators: None observed

Abuse Confidence Score: Not calculated

Known Attacker Status: False

Tor Exit Node: False

Spam Source: False

Blacklist Status: 1 of 8 DNSBL lists

The IP has no direct threat feed associations. However, 8 total DNSBL listings exist in the control plane, suggesting some level of reputation concerns.

---

## SUBNET ANALYSIS

Subnet: 51.222.95.0/24

Abuse Density: 70.7% (HIGH)

Total Siblings: 256

Active Siblings: 203

Threat Siblings: 181

Risk Assessment: The /24 subnet demonstrates concentrated abuse activity. Of 203 active sibling IPs, 181 are classified as threats. This indicates the subnet is part of a larger infrastructure that may be leveraged for coordinated malicious campaigns or shared hosting of compromised endpoints.

---

## NEIGHBORHOOD RISK DISTRIBUTION

Analyzed Neighbors: 100 sampled IPs

Risk Distribution: 100 Medium Risk, 0 High Risk, 0 Low Risk

Neighbor analysis reveals consistent medium-risk classification across the /24, suggesting systemic risk characteristics rather than isolated endpoint compromise.

---

## OBSERVATION HISTORY

Observation Count: 20 signals

Key Timeline Events:

• 2026-06-14: High-severity DNSBL listing detected (8 total lists)
• 2026-06-14: Subnet abuse classification confirmed (70.7% density)
• 2026-06-14: Geolocation data collected (CA/Singapore discrepancy)

Temporal Analysis: Ownership changes: 0; Threat observation count: 1. The IP shows minimal temporal volatility, suggesting established infrastructure rather than rapidly pivoted malicious use.

---

## RECOMMENDED ACTIONS

Immediate:

1. Monitor inbound/outbound traffic patterns for anomalies

2. Correlate with known Ahrefs platform activity to establish baseline

3. Validate geolocation data through reverse DNS and traceroute

Firewall Configuration:

• Allow: Standard web traffic (80/443) if business justification exists
• Block: Suspicious outbound connections to known threat IPs in 51.222.0.0/16
• Monitor: All traffic for DDoS or botnet behavior

Threat Intelligence Integration:

• Add to watchlist for subnet-based campaigns
• Cross-reference with Ahrefs platform threat feeds
• Monitor for certificate-based correlations

---

## RISK ASSESSMENT MATRIX

---

ASSIGNMENT: SOC Analyst

STATUS: Monitor / Investigate Subnet Context

PRIORITY: Medium

The endpoint represents moderate standalone risk but requires heightened awareness due to subnet-level abuse density. Recommend correlating with organizational threat feeds to determine if this IP is being leveraged in active campaigns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.