51.89.129.146📋 Copy

# IP INTELLIGENCE BRIEFING: 51.89.129.146

## Executive Summary

The IP address 51.89.129.146 presents a moderate-risk threat profile with multiple indicators of malicious activity. The IP is associated with OVH cloud infrastructure in London, GB, and exhibits DNSBL listings and blacklist associations. The subnet shows high abuse density with 196 threat siblings out of 256 total IPs.

## Threat Profile

• Risk Score: 50 (Moderate Risk)
• Reputation: Moderate Risk
• Provider: OVH (ASN 16276)
• Organization: Ahrefs Pte Ltd Dmytro
• Location: London, England, GB
• Network Role: CloudCompute, Hosting Infrastructure
• Classification: High Abuse

## Technical Observations

• DNS Resolution: proxy-uk008-san146.ahrefs.net (ahrefs.net)
• Services: No open ports detected; firewalled/no services
• DNSBL Listings: 2 lists flagged out of 8 total (max severity: high)
• Control Plane: BGP prefix 51.89.0.0/16, Route stability: false
• Operator Score: 0.2174 (Minimal)

## Observed Threat Indicators

• Blacklist Status: Listed on 8 blacklist sources with high severity
• Threat Feed Associations: 0 known campaigns
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Threat Persistence: 0 days (not persistently malicious)

## Historical Activity

• Observation Count: 23 signals recorded
• Recent Activity: Signals observed on 2026-06-28 and 2026-06-20
• Geolocation Signals: GB location with 0.28 confidence (multi-signal inference)
• Subnet Abuse Density: 0.7656 (high_abuse classification)
• Threat Siblings: 196 threat-related IPs in /24 subnet

## Neighborhood Analysis

• Subnet: 51.89.129.0/24
• Total Siblings: 256 IPs
• Active Siblings: 206
• Threat Siblings: 196
• Risk Distribution: 0 high-risk, 33 medium-risk, 67 low-risk neighbors
• Inherited Risk: 30 (from subnet context)
• Abuse Density: 0.7656

## Related Entities

• Network Relationships: 48 relationships identified, primarily Same Network (OVH_282347344)
• DNS Relationships: ahrefs.net domain association
• Certificate Relationships: 0 certificates

## Recommended Actions

Based on the moderate-risk profile and blacklist associations, the following defensive measures are recommended:

1. Firewall Rules: Implement rate limiting or geo-blocking for the 51.89.0.0/16 range if not already in place

2. Monitoring: Enable enhanced logging for traffic from this IP to the organization's network

3. Threat Hunting: Investigate the 196 threat-sibling IPs in the /24 subnet for coordinated activity

4. DNS Filtering: Block or monitor ahrefs.net if not an authorized domain

## Risk Assessment Summary

This IP represents a moderate threat primarily due to DNSBL listings, high-severity blacklist associations, and operation within a high-abuse cloud hosting environment. The subnet context suggests potential for coordinated malicious activity. Monitor for patterns of abuse and maintain defensive controls against the originating infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.