51.89.129.147📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 51.89.129.147/32

Date: 2026-06-20

Classification: Moderate Risk (Score: 40)

Provider: OVH (ASN 16276)

---

## EXECUTIVE SUMMARY

IP 51.89.129.147 operates as an OVH cloud infrastructure node hosting Ahrefs proxy services. While the individual IP shows moderate risk characteristics, it resides within a high-abuse density subnet (51.89.129.0/24) with 0.7422 abuse density. No active malicious indicators detected for this specific address, though neighborhood context warrants monitoring.

---

## RISK ASSESSMENT

Individual IP Risk Score: 40/100 (Moderate)

Inherited Subnet Risk: 29/100

Abuse Density: 0.7422 (High)

Threat Indicators:

• Blacklist count: 0
• Known attacker: No
• Spam source: No
• Tor exit node: No
• Persistent malicious activity: No

Network Classification: CloudCompute infrastructure (OVH) with hosted domain ahrefs.net. No open ports or active services detected.

---

## GEOLOCATION & INFRASTRUCTURE

• Location: London, England, GB
• ASN: 16276 (OVH)
• BGP Prefix: 51.89.0.0/16
• DNS Host: proxy-uk008-san147.ahrefs.net
• Geolocation Consensus: Valid (5 probes, 89.6ms avg RTT)

---

## NEIGHBORHOOD ANALYSIS (51.89.129.0/24)

• Total Siblings: 256
• Active Siblings: 194
• Threat Siblings: 190
• Risk Distribution: 65 medium-risk, 35 low-risk, 0 high-risk in sampled set
• Abuse Classification: High

The subnet demonstrates elevated abuse density despite the target IP's clean signal profile. This suggests potential IP sharing or resource abuse within the broader OVH infrastructure block.

---

## OBSERVATION HISTORY

19 observations recorded (most recent: 2026-06-20). Historical signals indicate:

• No ownership changes
• No persistent malicious activity
• No blacklist entries
• Consistent geolocation from London, GB

---

## RECOMMENDED ACTIONS

Recommended Security Controls:

SOC Analyst Guidance:

• Monitor inbound traffic patterns from this subnet (51.89.129.0/24)
• Consider subnet-level blocking if traffic patterns indicate abuse
• Validate against local threat intelligence before implementing block rules
• The moderate risk score combined with high neighborhood abuse density warrants enhanced logging

---

Classification: Internal Use

Sources: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.