51.222.95.89📋 Copy

## IP INTELLIGENCE BRIEFING: 51.222.95.89/32

Classification: Moderate Risk (Score: 40/100) | Provider: OVH SAS | ASN: 16276

Executive Summary

IP 51.222.95.89 is a cloud-hosted infrastructure address registered to Ahrefs Pte Ltd under OVH SAS. While the IP itself shows no direct threat indicators, it resides within a subnet exhibiting high abuse density (0.7227) with 185 of 256 sibling IPs classified as threats. Geographic validation anomalies detected.

Ownership & Infrastructure

• Organization: Dmytro, Ahrefs Pte Ltd (OVH-CUST-281059689)
• Network Block: 51.222.95.0/24
• Infrastructure Type: Cloud Compute / Hosting
• PTR Hostname: proxy-ca010-san89.ahrefs.net
• Service Status: Firewalled / No Services Detected

Geolocation Anomalies

Reported location shows Canada (QC) with Singapore city designation. RTT validation failure detected: measured 25ms RTT against minimum possible 112ms for 5,598km distance. This discrepancy suggests either misconfigured geolocation data or spoofed origin information.

Threat Context

• Direct Threat Indicators: None (not known attacker, not spam source, not Tor exit)
• DNSBL Status: Listed on 1 of 8 threat feeds
• Subnet Risk Profile: High Abuse Classification

- 206 active siblings in /24

- 185 threat siblings identified

- Abuse density: 0.7227 (elevated)

• Historical Signals: 19 observations recorded. Recent activity includes threat pulses detected on 2026-06-15.

Network Reputation

• Operator Score: 0.2174 (Minimal)
• Route Stability: False (routing changes observed)
• BGP Prefix: 51.222.0.0/16
• Campaign Correlation: No active campaign matches

Recommended Actions

Firewall blocking recommended due to subnet-level risk concentration:

```bash

# iptables

iptables -A INPUT -s 51.222.95.89 -j DROP

# nftables

nft add rule inet filter input ip saddr 51.222.95.89 drop

# Cloudflare WAF

Expression: ip.src eq 51.222.95.89 → Action: Block

# AWS WAF

Addresses: 51.222.95.89/32 → Action: Block

```

Intelligence Assessment

The IP exhibits moderate risk primarily through proximity to high-abuse neighbors rather than autonomous malicious activity. The subnet classification as "high_abuse" with significant threat sibling concentration warrants defensive posture. Geographic inconsistencies require additional verification. SOC teams should monitor for outbound connections from this IP to determine if it's being compromised or used as a proxy for command-and-control communications.

Priority: Medium – Block at perimeter, monitor for activity patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.