51.89.129.163📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 51.89.129.163/32

Date: 2026-06-19

Classification: Moderate Risk (Score: 40/100)

---

## EXECUTIVE SUMMARY

IP address 51.89.129.163 is a cloud compute endpoint operated by OVH (ASN 16276) in London, England, registered to Ahrefs Pte Ltd. The IP resolves to proxy-uk008-san163.ahrefs.net and presents moderate risk (40/100). While no active threat indicators or known attack campaigns are associated with this specific address, the IP resides within a high-abuse density subnet (51.89.129.0/24) where 70% of sibling IPs exhibit medium risk and 30% exhibit low risk.

---

## OWNERSHIP & GEOLOCATION

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH)
• Country: GB (London, England)
• Geolocation Confidence: High (5 probe sources, consensus confirmed)
• Infrastructure Type: Cloud Compute / Hosting
• Network Classification: Not residential, proxy, CDN, or Tor

---

## NETWORK ENVIRONMENT ANALYSIS

The IP is embedded in subnet 51.89.129.0/24 with the following characteristics:

Risk Distribution in /24: 70% medium risk, 30% low risk, 0% high risk (sample of 100 neighbors analyzed).

The high abuse density indicates this subnet contains significant malicious activity, though the target IP itself shows no active threat indicators.

---

## THREAT INTELLIGENCE

Current Threat Status:

• Threat Indicators: None detected
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0 (direct)
• DNSBL Listed: 1/8 lists

Control Plane Data:

• Route Stability: False
• DNSSEC Valid: Yes
• RPKI State: Not evaluated
• IRR Consistency: Not evaluated

---

## OBSERVATION HISTORY

Recent signals (June 2026) indicate:

• 2026-06-19 20:52: Operator score 0.2174 (Minimal)
• 2026-06-19 21:00: Subnet classification updated to "high_abuse" with 0.707 abuse density
• 2026-06-14 20:56: DNS resolution confirmed for ahrefs.net domain with CAA records present
• 2026-06-14 20:54: Geolocation confirmed in GB with 750km accuracy radius

No persistent malicious behavior detected. Ownership changes: 0. Threat persistence: 0 days.

---

## INFRASTRUCTURE RELATIONSHIPS

The IP maintains 53 documented relationships, primarily with network infrastructure entities (OVH_282347344). No connections to known malicious campaigns, certificates, or related threat actors identified.

---

## RECOMMENDED ACTIONS

Based on risk profile and neighborhood analysis, the following firewall rules are recommended:

```bash

# iptables

iptables -A INPUT -s 51.89.129.163 -j DROP

# nftables

nft add rule inet filter input ip saddr 51.89.129.163 drop

# pfSense

51.89.129.163/32

```

Platform-Specific Rules:

• Cloudflare WAF: Block IP with expression `ip.src eq 51.89.129.163`
• AWS WAF: Add to blocked addresses list: 51.89.129.163/32
• nginx: `deny 51.89.129.163;`

---

## ANALYST NOTES

1. Context: While the IP itself shows no active threat indicators, the parent subnet exhibits high abuse density. Consider blocking the entire /24 if acceptable for your threat model.

2. Legitimate Use: The IP resolves to a legitimate ahrefs.net domain, suggesting potential legitimate use. However, the high abuse neighborhood warrants caution.

3. Recommendation: Implement rate limiting or connection throttling as an intermediate measure before full blocking. Monitor for any changes in behavior from this IP or adjacent addresses in the /24 subnet.

4. Related Subnet: Consider analyzing adjacent subnets (51.89.128.0/24, 51.89.130.0/24) for additional threat intelligence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.