51.222.95.88📋 Copy

# IP Intelligence Briefing: 51.222.95.88/32

Classification: Moderate Risk Infrastructure Node | Date: Current Assessment | Risk Score: 40/100

## Executive Summary

IP address 51.222.95.88 is a cloud-hosting node within the OVH-CUST-281059689 customer block (ASN 16276), operated by Ahrefs Pte Ltd. The IP maintains moderate risk characteristics with no active threat indicators but resides in a high-abuse-density subnet (51.222.95.0/24) with 75% abuse classification. The asset is not currently associated with known campaigns or persistent malicious activity.

## Technical Profile

Ownership & Classification:

• Organization: Dmytro, Ahrefs Pte Ltd
• AS Number: 16276 (OVH)
• Infrastructure Type: CloudCompute / Hosting
• PTR Record: proxy-ca010-san88.ahrefs.net
• Resolved Domain: ahrefs.net

Geolocation Discrepancy:

The IP is geolocated to Canada (QC) with Singapore city designation, presenting a validation violation. Round-trip time measurements indicate a 27ms latency against a minimum theoretical 112ms for the reported 5,598km distance, suggesting unreliable location data.

Network State:

• Services: None detected (firewalled/no services)
• Open Ports: None
• TLS Certificates: None
• DNSBL Listings: 1/8 total lists

## Neighborhood Assessment

The /24 subnet (51.222.95.0/24) exhibits elevated abuse characteristics:

• Abuse Density: 0.75 (high_abuse classification)
• Threat Siblings: 192 of 256 total IPs
• Inherited Risk Score: 30/100
• Peer Risk Distribution: All sampled neighbors (n=100) show medium risk scores (40)

## Historical Signals

Analysis of 22 historical observations reveals:

• Threat Persistence: 0 days (no persistent malicious activity)
• Recent Listings: Multiple blacklist entries with "high" severity observed
• Operator Score: 0.2174 (Minimal)
• Route Stability: Unstable routing with zero route changes in 30 days

## Threat Indicators

• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False
• Active Campaigns: None detected
• Blacklist Count: 0 (direct)

## SOC Recommendations

Monitoring Priority: LOW-MEDIUM

• Implement passive monitoring for emerging threat activity
• No immediate blocking required; the IP is not actively malicious
• Monitor subnet-wide activity given high abuse density context

Firewall Rules:

• Allow traffic if legitimate Ahrefs business communication is expected
• Consider subnet-level filtering for 51.222.95.0/24 given elevated abuse metrics
• No specific blocking rules generated based on current risk profile

Action Items:

• Validate legitimate business purpose for this Ahrefs infrastructure node
• Monitor for changes in DNSBL listings or threat signal emergence
• Review subnet-level policies if incident correlation occurs with neighboring IPs

---

*Intel generated from IPDebrief analysis. All data sourced from active observation and intelligence feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.