51.89.129.196📋 Copy

# IP Intelligence Briefing: 51.89.129.196/32

Classification: Moderate Risk (Score: 50)

Date: 2026-06-28

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP 51.89.129.196 is a cloud computing infrastructure address hosted by OVH in London, England. The IP maintains moderate risk characteristics with a risk score of 50 and operates as a hosting provider within the 51.89.0.0/16 CIDR block. The subnet demonstrates elevated abuse density (0.75) with 192 of 256 sibling IPs flagged as threats. No active malicious indicators were detected against this specific address, though the neighborhood context warrants monitoring.

---

## Infrastructure Profile

The IP resolved to hostname proxy-uk008-san196.ahrefs.net via reverse DNS. No open ports, TLS certificates, or active services were observed. The IP is classified as cloud infrastructure and is not associated with Tor, VPN, CDN, or proxy networks.

---

## Threat Assessment

Current Risk Score: 50 (Moderate Risk)

Threat Indicators:

• No active threat indicators detected
• Not listed as known attacker or spam source
• Blacklist count: 0
• DNSBL listed: 2 of 8 total lists
• No associated threat campaigns or certificates

Control Plane Data:

• BGP Prefix: 51.89.0.0/16
• Origin ASN: 16276
• Route stability: Not stable
• DNSSEC valid: Yes

---

## Neighborhood Analysis

Subnet: 51.89.129.196/24

Risk Distribution:

• High Risk: 0 IPs
• Medium Risk: 40 IPs
• Low Risk: 60 IPs

The subnet exhibits elevated abuse density with 75% abuse classification. This IP inherits 30% risk from neighborhood context.

---

## Historical Observations

Total Observations: 19 signals

Key historical signals:

• 2026-06-28: Cloud infrastructure classification (OVH, confidence 0.90)
• 2026-06-20: Port scanning activity detected; subnet abuse density confirmed at 0.75
• 2026-06-20: DNS resolution to ahrefs.net domain confirmed

The IP has demonstrated persistence as cloud hosting infrastructure with consistent OVH provider attribution.

---

## Network Relationships

Relationship Count: 36 total relationships

Primary relationship type: Same Network (OVH_282347344)

All relationships indicate shared network infrastructure within the OVH provider network.

---

## Recommended Actions

Firewall Recommendations:

• iptables: `iptables -A INPUT -s 51.89.129.196 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 51.89.129.196 drop`
• nginx: `deny 51.89.129.196;`
• pfSense: `51.89.129.196/32`
• Cloudflare WAF: Block IP with expression `ip.src eq 51.89.129.196`
• AWS WAF: Block address `51.89.129.196/32`

Note: These recommendations are probabilistic and should be combined with other signals before taking action.

---

## Intelligence Conclusion

IP 51.89.129.196 presents moderate risk as part of a high-abuse-density cloud hosting subnet. While the specific IP shows no active threat indicators, the neighborhood context (192 threat siblings, 0.75 abuse density) suggests elevated risk exposure. The IP is associated with legitimate hosting infrastructure (ahrefs.net reverse DNS), but the subnet's abuse profile warrants defensive monitoring. No immediate blocking is required absent additional contextual signals, though the provided firewall rules may be applied based on organizational policy.

Recommendation: Monitor subnet-level activity; apply blocking rules if organizational risk tolerance permits.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.