51.89.129.189📋 Copy

## IP INTELLIGENCE BRIEFING: 51.89.129.189

Classification: Moderate Risk (Score: 40)

Date of Analysis: June 2026

---

**OVERVIEW**

IP address 51.89.129.189 is a cloud hosting endpoint operated by OVH (ASN 16276) within the 51.89.0.0/16 prefix. The endpoint resolves to the PTR hostname proxy-uk008-san189.ahrefs.net and is associated with the organization Ahrefs Pte Ltd Dmytro. Geographic attribution indicates London, England, GB, though geolocation confidence is low (accuracy radius: 750km).

---

**INFRASTRUCTURE PROFILE**

• Network Role: Cloud compute infrastructure with hosting services
• Infrastructure Type: CloudCompute
• Service Status: Firewalled / No services actively responding
• Open Ports: None detected
• TLS Certificate: None detected
• ISP/Provider: OVH (providerScore: 0)

Control Plane Indicators:

• BGP Prefix: 51.89.0.0/16
• Origin ASN: 16276
• Route Stability: Unstable (isRouteStable: false)
• DNSSEC: Valid
• RPKI State: Not applicable
• DNSBL Listings: 1 of 8 total lists

---

**THREAT ASSESSMENT**

Risk Indicators:

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence Score: Not available
• Known Campaigns: None identified
• Is Tor Exit: False
• Is Known Attacker: False
• Is Spam Source: False
• Blacklist Count: 0

Behavioral Indicators:

• Honeypot Hits: 0
• Threat Observation Count: 0
• Persistent Malicious Activity: No
• Threat Persistence Days: 0

---

**NETWORK ENVIRONMENT ANALYSIS**

Subnet Neighborhood (51.89.129.0/24):

• Subnet Classification: High Abuse
• Abuse Density: 0.6328 (63.28%)
• Total Siblings: 256
• Active Siblings: 154
• Threat Siblings: 162
• Inherited Risk Score: 25

Risk Distribution in /24:

• High Risk: 0
• Medium Risk: 97
• Low Risk: 3

The subnet exhibits elevated abuse characteristics with 63% abuse density, indicating the endpoint operates within a high-density hosting environment.

---

**OBSERVATION HISTORY**

Total observations recorded: 22

Recent Activity Timeline:

• 2026-06-19 18:25 UTC: Operator score 0.2174, label "Minimal", confidence 0.60
• 2026-06-14 18:32 UTC: Network classification confirmed as OVH hosting infrastructure, confidence 0.85
• 2026-06-14 18:28 UTC: Geolocation inference (GB, London region), confidence 0.28
• 2026-06-14 18:24 UTC: Operator score 0.2174, label "Minimal"

Historical Trend: Consistent minimal threat posture with persistent hosting infrastructure characteristics. No escalation in risk signals observed.

---

**RELATIONSHIP GRAPH**

Total relationships: 46

Primary Relationship Types:

• Same Network: 41 relationships (OVH_282347344)
• Additional network-level relationships: 5

No significant cross-network or organizational relationships identified beyond the OVH infrastructure footprint.

---

**RECOMMENDED SECURITY ACTIONS**

Firewall/Network Policy:

1. Monitor for outbound connections to 51.89.0.0/16 prefix

2. Consider blocking if traffic patterns indicate abuse consistent with high-abuse subnet

3. No specific block recommendation based on current risk profile (score: 40)

Detection Signatures:

• No active threat indicators detected
• No malware/hash signatures associated
• No known campaign correlation

Additional Context:

• The IP is associated with legitimate hosting infrastructure (Ahrefs)
• No active malicious activity observed
• Consider monitoring rather than blocking due to moderate risk score and hosting infrastructure role

---

**SUMMARY**

IP 51.89.129.189 is a cloud hosting endpoint operating within a high-abuse density subnet. The endpoint shows moderate risk characteristics with no active threat indicators. While the subnet environment exhibits elevated abuse metrics (63.28% abuse density), this specific IP demonstrates consistent, non-malicious hosting behavior. Recommended approach: Monitor traffic patterns rather than implement blocking rules, as the IP serves legitimate infrastructure purposes and maintains minimal threat posture throughout observation history.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.