51.222.95.33📋 Copy

IP Intelligence Briefing: 51.222.95.33

Date: 2026-06-01

---

**1. Core Profile**

• Risk Score: 25 (Low Risk)
• Provider: OVH (ASN 16276)
• Organization: Dmytro, Ahrefs Pte Ltd
• Geolocation:

- Country: Canada (CA)

- City: Singapore (inferred, conflicting with distance metrics)

- RTT Anomaly: 26ms (discrepancy with 5,598km distance; potential spoofing)

• Network Role: CloudCompute (OVH infrastructure, no public services)
• Threat Indicators: None detected (no malware, spam, or attack campaigns).

---

**2. Observation History**

• Recent Activity (Last 30 Days):

- Scans: 17 total observations (0.70–0.35 confidence). No malicious payloads or open ports detected.

- Traceroute: Geolocation inconsistency (low RTT vs. long distance).

- Subnet Abuse: Mixed risk (abuse density 0.396; 99/250 siblings flagged as threats).

- DNS: PTR record points to `proxy-ca010-san33.ahrefs.net` (likely legitimate Ahrefs infrastructure).

---

**3. Relationships**

• Network Associations:

- Linked to OVH network `OVH-CUST-281059689`.

- DNS hostname `proxy-ca010-san33.ahrefs.net` (Ahrefs Pte Ltd).

• No Known Malicious Connections: No ties to C2 servers, phishing domains, or blacklists.

---

**4. Neighborhood Analysis**

• Subnet: `51.222.95.33/24`
• Risk Distribution:

- 69 IPs flagged as medium risk (avg. 40 score).

- 31 IPs low risk (avg. 25 score).

• Abuse Density: 0.396 (moderate risk; 99/250 siblings flagged).

---

**5. Actionable Insights**

• Monitor Subnet: The /24 subnet contains mixed-risk IPs; prioritize monitoring high-risk siblings.
• Verify Geolocation: Investigate the RTT anomaly (26ms vs. 5,598km distance) for potential spoofing or misconfigured routing.
• Confirm DNS Validity: Ahrefs’ DNS record appears legitimate but validate against known good lists (e.g., DNSBLs).
• No Immediate Threat: No malicious indicators detected, but the subnet’s abuse density suggests broader network scrutiny.

---

Conclusion: 51.222.95.33 is a low-risk cloud instance associated with Ahrefs, with no direct malicious activity. However, its subnet contains moderate-risk neighbors, warranting further investigation into potential lateral movement or shared infrastructure compromises.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.