51.77.201.73📋 Copy

# IP Intelligence Briefing: 51.77.201.73/32

Classification: Moderate Risk Cloud Infrastructure Host

Date: Analysis based on current intelligence data

Risk Score: 50/100

## Executive Summary

IP 51.77.201.73 is a cloud computing host operated by OVH SAS within the PCI-SBG6 network block (51.77.200.0/22) in France. The IP hosts a VPS instance (vps-8242e103.vps.ovh.net) running nginx/1.18.0 with standard web services. While no active threat campaigns were detected, the IP carries a moderate risk profile with DNSBL listings present in historical observations.

## Technical Profile

## Services & Fingerprinting

• Open Ports: TCP/80 (HTTP), TCP/443 (HTTPS), TCP/22 (SSH)
• Web Server: nginx/1.18.0 (Ubuntu)
• TLS Certificate: Let's Encrypt (CN=eqwanza.fr)
• SPF: Configured (v=spf1 include:mx.ovh.com -all)
• DMARC: Not configured

## Threat Indicators

• Current Blacklist Count: 0
• DNSBL Listed: 2 of 8 total lists
• Known Campaigns: None detected
• Tor Exit/Proxy: Negative
• Abuse Confidence Score: Not assigned

## Neighborhood Analysis

Subnet 51.77.201.0/24 shows clean classification with zero abuse density. No threat siblings detected in the immediate /24 neighborhood. The IP appears isolated from coordinated abuse activity within its subnet.

## Historical Observations

26 total observations recorded. Recent monitoring indicates:

• DNSBL listings with high severity classification observed
• SPF record present but DMARC absent
• No persistent malicious behavior patterns detected
• Ownership stability maintained with zero changes

## Recommended Actions

Based on risk score 50, the following controls are recommended:

## Intelligence Notes

The IP hosts a legitimate VPS configuration for the domain eqwanza.fr. Historical DNSBL listings may indicate past abusive activity or false positives common in shared cloud infrastructure. The absence of coordinated threat indicators and clean neighborhood data suggests limited current threat relevance. SOC teams may consider this IP for monitoring if inbound traffic patterns indicate scanning or exploitation attempts, though no active campaigns were identified.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.