51.75.236.149📋 Copy

# IPDebrief Intelligence Briefing

IP Address: 51.75.236.149/32

Classification: Cloud Compute / Hosting Infrastructure

Report Date: June 2026

## Executive Summary

IP 51.75.236.149 is a cloud-hosting endpoint associated with Ahrefs Pte Ltd Dmytro (OVH, ASN 16276), located in France. The IP carries a moderate risk score of 50 and operates as firewalled cloud infrastructure. While the endpoint itself shows no direct threat indicators, the /24 neighborhood exhibits high abuse density (0.7188) with 23 of 29 active sibling IPs flagged as threats.

## Technical Profile

## Risk Assessment

Current Risk Score: 50 (Moderate)

Abuse Confidence: Not applicable (no active threat indicators)

Blacklist Count: 0

Known Attacker: No

Spam Source: No

Tor Exit/Proxy: No

Operator Score: 0.2174 (Minimal) — indicates legitimate hosting infrastructure

Control Plane Status: Stable routing (no route changes in 30 days)

## Neighborhood Context (51.75.236.0/24)

The /24 subnet shows elevated abuse activity:

• Total Siblings: 32 IPs
• Active Siblings: 29 IPs
• Threat Siblings: 23 IPs
• Abuse Density: 0.7188 (High)
• Inherited Risk: 28

Risk distribution across neighborhood:

• High Risk: 0 IPs
• Medium Risk: 11 IPs
• Low Risk: 20 IPs

This indicates the subnet is hosted by OVH and contains multiple endpoints with varying risk levels, consistent with cloud hosting infrastructure.

## Observation History

Historical signal analysis (20 observations) shows consistent classification:

• Network classification: OVH cloud hosting
• Geolocation: France (consensus across multiple signals)
• DNS: ahrefs.net domain with CAA records present
• No evidence of persistent malicious behavior or ownership changes

## Threat Indicators

Direct Threats: None detected

• No malicious campaigns correlated
• No known attacker flags
• No spam source designation
• No blacklist listings on IP

Behavioral Signals:

• DNSSEC valid: Yes
• DNSSEC CAA records: Present
• HSTS/CSP headers: Not detected
• No HTTP/2 or referrer policy headers

## Recommended Security Actions

Based on risk profile and neighborhood context, the following firewall rules are recommended:

Firewall Blocking Rules

```bash

# iptables

iptables -A INPUT -s 51.75.236.149 -j DROP

# nftables

nft add rule inet filter input ip saddr 51.75.236.149 drop

# nginx

deny 51.75.236.149;

# pfSense

51.75.236.149/32

# Cloudflare WAF

{"description":"Block 51.75.236.149 — IPDebrief risk score 50","action":"block","filter":{"expression":"ip.src eq 51.75.236.149"}}

# AWS WAF

{"Addresses":["51.75.236.149/32"],"Description":"IPDebrief risk 50"}

```

## Intelligence Notes

1. Infrastructure Legitimacy: The IP resolves to a known hosting provider (OVH) with enterprise domain (ahrefs.net). No direct evidence of malicious use.

2. Neighborhood Risk: The /24 subnet shows 72% abuse density. Consider blocking the entire /24 range or monitoring sibling IPs for correlated activity.

3. Traffic Patterns: No open ports detected; endpoint appears to be firewalled. Likely used for backend services or proxy infrastructure.

4. Recommendation: Apply blocking rules to protect internal resources. Monitor for any activity from this IP or its /24 neighbors.

Status: Monitor / Block — Moderate risk with high-abuse neighborhood context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.