51.222.95.95📋 Copy

# IP INTELLIGENCE BRIEFING: 51.222.95.95/32

Classification: Moderate Risk | Risk Score: 40 | Report Date: June 2026

## Executive Summary

IP 51.222.95.95 is a cloud infrastructure endpoint hosted on OVH (ASN 16276) under customer account OVH-CUST-281059689, associated with domain ahrefs.net. The IP presents moderate risk with no active threat indicators, but operates within a high-abuse density subnet (0.7188) containing 184 threat-identified siblings out of 256 total addresses.

## Ownership and Infrastructure

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• Netname: OVH-CUST-281059689
• RIR: ARIN
• Infrastructure Type: Cloud Compute (OVH)
• Service Status: Firewalled / No Services detected

## Geolocation Intelligence

• Country: Canada (CA) - Confidence: 0.35
• Region: QC
• City: Singapore (reported; geolocation confidence low)
• Accuracy Radius: 3000 km
• GeoValidation: GeoPlausible flag set to false

The geolocation data shows inconsistency with multiple sources reporting Canada, while the city field indicates Singapore. This discrepancy warrants monitoring.

## Threat Profile

• Threat Indicators: None detected
• Known Attacker: False
• Spam Source: False
• Tor Exit: False
• Blacklist Count: 0
• DNSBL Listings: 1 of 8 total lists
• Reputation Sources: None active

## DNS and Hostname Resolution

• PTR Hostname: proxy-ca010-san95.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed
• Forward Hostnames: proxy-ca010-san95.ahrefs.net
• Email Authentication: SPF: False, DMARC: False

The IP resolves to a hostname associated with ahrefs.net, a legitimate SEO analytics and marketing platform.

## Neighborhood Analysis

• Subnet: 51.222.95.0/24
• Abuse Density: 0.7188 (High Abuse Classification)
• Inherited Risk: 28
• Total Siblings: 256
• Active Siblings: 232
• Threat Siblings: 184

The /24 subnet exhibits elevated abuse activity with 72% abuse density. Of 232 active sibling IPs, 184 have been identified as threats.

## Historical Signal Analysis

23 observations recorded. Recent signals (June 2026) show:

• Operator Score: 0.4348 (Basic classification)
• Route Stability: Stable (route changes: 0 in 30 days)
• BGP Prefix: 51.222.0.0/16
• RPKI State: Valid
• DNSSEC: Valid
• Threat Persistence Days: 0
• Is Persistently Malicious: False

No escalating threat pattern observed. Risk profile remains stable.

## Network Relationships

49 relationships identified, primarily network-level associations with OVH-CUST-281059689. No certificate or hostname correlations beyond the ahrefs.net domain.

## Recommended Security Actions

Based on risk score of 40 and subnet abuse context, the following controls are recommended:

Firewall Rules:

• iptables: `iptables -A INPUT -s 51.222.95.95 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 51.222.95.95 drop`
• nginx: `deny 51.222.95.95;`
• pfSense: `51.222.95.95/32`
• Cloudflare WAF: Block with filter expression `ip.src eq 51.222.95.95`
• AWS WAF: Add `51.222.95.95/32` to rule set

## Assessment

This IP presents moderate risk with contextual threat indicators driven by subnet-level abuse patterns rather than direct malicious activity. The association with ahrefs.net suggests legitimate use, but the high-abuse neighborhood warrants defensive positioning. Monitor for changes in geolocation data, DNSBL listings, or emergence of threat indicators.

Priority: LOW-MEDIUM

Recommended Action: Implement blocking at perimeter firewall; monitor for behavioral changes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.