51.89.129.42📋 Copy

INTELLIGENCE BRIEFING: 51.89.129.42/32

OVERVIEW

IP 51.89.129.42 is a cloud infrastructure address hosted on OVH (ASN 16276) in London, England. The IP carries a moderate risk score of 40, with classification flags indicating hosted cloud compute infrastructure. No active services or open ports were detected during scanning.

OWNERSHIP & INFRASTRUCTURE

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH)
• Registration: RIR RIPE NCC, allocated 2001-02-15
• Infrastructure Type: CloudCompute (OVH)
• Network Role: Hosting provider with firewall protection
• DNS Resolution: proxy-uk008-san42.ahrefs.net (ahrefs.net)

GEOLOCATION

• Country: United Kingdom (GB)
• Region: England
• City: London
• Geolocation Confidence: High (geo consensus confirmed, 5 probes)
• Network Origin: BGP prefix 51.89.0.0/16, route stable

THREAT INDICATORS

• Risk Score: 40 (Moderate)
• DNSBL Status: Listed on 1 of 8 threat feeds
• Known Campaigns: None identified
• Campaign Likelihood: Not applicable
• Tor/Proxy/VPN: Not detected
• Malicious Activity: No known attacker or spam source indicators

NEIGHBORHOOD ANALYSIS

The /24 subnet (51.89.129.0/24) shows elevated abuse characteristics:

• Abuse Density: 0.7344 (high abuse classification)
• Total Siblings: 256 addresses
• Active Siblings: 182
• Threat Siblings: 188
• Inherited Risk: 29
• Network Classification: High abuse density subnet

Neighbor analysis indicates consistent risk scores (40) across the subnet with medium authority ratings.

OBSERVATION HISTORY

• Total Observations: 24 signals
• Latest Activity: 2026-06-20
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0
• Route Changes (30d): 0
• Threat Observation Count: 1

Historical signals confirm stable network assignment (prefix 51.89.0.0/16) and consistent ASN attribution to 16276.

NETWORK BEHAVIOR

• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: None (firewalled/no services)
• Server Banner: None
• HTTP Headers: No HSTS, CSP, or permissions policy headers

RECOMMENDED ACTIONS

Based on the moderate risk classification and hosted infrastructure nature:

• Monitor for any service initiation or port opening
• The IP is associated with Ahrefs infrastructure; verify against known Ahrefs IP ranges
• DNSBL listing requires investigation but does not indicate active malicious use
• Subnet-level abuse density suggests broader monitoring of 51.89.129.0/24 is warranted

ASSESSMENT

The IP represents standard cloud hosting infrastructure for Ahrefs services. While DNSBL listing exists and the subnet shows elevated abuse density, no active threat indicators were identified. The moderate risk score reflects the hosting provider context rather than confirmed malicious activity. SOC teams should maintain awareness of the subnet's abuse characteristics while treating the IP as legitimate cloud infrastructure unless contradictory intelligence emerges.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.