51.75.119.154📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target IP: 51.75.119.154/32 | Date: 2026-06-18 | Classification: MODERATE RISK

---

## EXECUTIVE SUMMARY

IP 51.75.119.154 is a cloud hosting infrastructure endpoint operated by OVH SAS located in Roubaix, France. The IP exhibits a moderate risk profile (score: 40/100) with no known malicious indicators. However, the associated /24 subnet demonstrates elevated abuse density (0.6), warranting enhanced monitoring.

---

## OWNERSHIP & GEOLOCATION

---

## NETWORK PROFILE

Active Services:

• Port 22/TCP: SSH (OpenSSH_9.6p1 Ubuntu-3ubuntu13.16)

DNS Resolution:

• PTR: ns3139187.ip-51-75-119.eu
• Forward DNS: ip-51-75-119.eu

---

## THREAT INDICATORS

Threat Feeds: No detections across monitored sources.

---

## SUBNET ANALYSIS (51.75.119.0/24)

• Classification: High Abuse
• Abuse Density: 0.6 (60%)
• Total Siblings: 10
• Active Siblings: 9
• Threat Siblings: 6

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 5
• Low Risk: 4

Notable Neighbors:

• 51.75.119.69, 75, 153, 161, 168, 173: Risk score 40
• 51.75.119.112, 165, 168, 229: Risk score 25

---

## OBSERVATION HISTORY

Total Observations: 23

Latest Activity: 2026-06-18 13:18 UTC

Key Historical Signals:

• Subnet abuse density: 0.6 (high_abuse) - confidence 0.75
• DNS blacklist listings: 1 of 8 total (high severity) - confidence 0.85
• Operator score: 0.2609 (Basic) - confidence 0.60
• Overall confidence: 0.2525 across 6 dimensions

Temporal Analysis:

• Ownership changes: 0
• Threat persistence: 0 days
• Persistently malicious: No

---

## RELATIONSHIP GRAPH

Total Relationships: 52

• Same Network: Multiple instances (SD-1G-GRA2-G222)
• DNS Association: ns3139187.ip-51-75-119.eu

---

## RECOMMENDED ACTIONS

Risk-Based Recommendation: BLOCK (probabilistic)

---

## ANALYST NOTES

1. Legitimate Infrastructure: IP operates on standard Ubuntu SSH server with normal hosting provider characteristics. No evidence of command-and-control, malware distribution, or abuse activity.

2. Subnet Context: The /24 subnet shows elevated abuse density (0.6), suggesting potential for shared hosting environments where compromised instances may originate from the same network block.

3. Route Instability: Control plane indicates unstable routing (isRouteStable: false), which may indicate dynamic cloud infrastructure rather than static hosting.

4. Action Guidance: While no active threats detected, consider:

- Blocking if this IP appears in inbound traffic logs

- Monitoring for SSH brute force attempts

- Correlating with any known malicious TTPs from the subnet

Classification: MODERATE RISK - Monitor / Block based on contextual threat intelligence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.