51.222.95.77📋 Copy

IP Threat Intelligence Briefing: 51.222.95.77

Date: 2026-06-15

---

**1. IP Profile**

• Risk Score: Moderate (40/100)
• Ownership: Owned by OVH (AS16276), registered to "Dmytro, Ahrefs Pte Ltd"
• Geolocation:

- Country: Canada (QC, Quebec)

- Geo Validation: Flagged as implausible (RTT anomaly for distance).

• Network Role: CloudCompute infrastructure (OVH-hosted, no residential/mobile signals).
• Threat Indicators: No direct malicious activity detected (no indicators, blacklists, or campaigns).

---

**2. Observation History**

• Recent Activity (Last 30 Days):

- 1 observation of high-risk subnet (51.222.95.77/24) with abuse density 59.77%.

- 1 threat signal flagged via AlienVault OTX (reputation score 0, 1 pulse detected).

• Trend: Stable risk profile; no escalation in threats or scans.

---

**3. Network Relationships**

• Subnet: 51.222.95.0/24
• Key Associations:

- Linked to OVH-CUST-281059689 (customer ASN).

- DNS: Resolves to `proxy-ca010-san77.ahrefs.net` (associated with Ahrefs).

- BGP: Origin ASN 16276, route stability: unstable (route changes in last 30 days).

---

**4. Neighborhood Analysis**

• Subnet Abuse Density: 59.77% (classified as high_abuse).
• Neighbor Risk Distribution:

- 78 IPs with medium risk (score 40–50).

- 22 IPs with low risk.

- 153 neighbors flagged as threat siblings (potential abuse or malicious activity).

---

**5. Recommended Actions**

• Firewall Rules:

- Block IP via:

```bash

iptables -A INPUT -s 51.222.95.77 -j DROP

nft add rule inet filter input ip saddr 51.222.95.77 drop

```

- Configure WAF rules (Cloudflare/AWS) to block the IP.

• Monitoring:

- Watch subnet 51.222.95.0/24 for abnormal traffic.

- Verify DNS resolution ties to Ahrefs (potential proxy/service).

• Investigation:

- Cross-check with Ahrefs infrastructure for legitimate use cases.

- Validate geo-plausibility anomalies (e.g., Singapore vs. Quebec).

---

Conclusion:

The IP is part of a high-abuse subnet hosted by OVH, with no direct malicious activity detected. However, its association with a high-risk subnet and potential proxy services warrants monitoring. Use the provided firewall rules to mitigate risk while investigating further.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.