51.89.129.48📋 Copy

# IP Intelligence Briefing: 51.89.129.48/32

## Executive Summary

IP 51.89.129.48 is a moderate-risk (40/100) cloud hosting IP address associated with OVH infrastructure in London, England. The address belongs to Ahrefs Pte Ltd Dmytro and resolves to the ahrefs.net domain. The IP exhibits a "firewalled / no services" operational state with no active open ports. While the individual IP shows moderate risk, the /24 subnet (51.89.129.0/24) demonstrates high abuse density (0.7461) with 74.6% of active siblings flagged as threats.

## Ownership and Geolocation

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Location: London, England, GB
• Infrastructure Type: CloudCompute (Cloud hosting)
• Registration: ARIN

## Network Characteristics

• DNS Resolution: proxy-uk008-san48.ahrefs.net
• PTR Record: proxy-uk008-san48.ahrefs.net
• Service Status: Firewalled / No Services Detected
• TLS/Certificates: None observed
• DNSBL Listed: 1 of 8 threat feeds

## Threat Profile

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence: Not applicable (no active threat indicators)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None
• Threat Feeds: Empty

## Subnet Intelligence (51.89.129.0/24)

• Total Siblings: 256
• Active Siblings: 194
• Threat Siblings: 191 (98.5% threat rate)
• Abuse Density: 0.7461 (High Abuse Classification)
• Inherited Risk Score: 29
• Risk Distribution: 58 medium-risk, 42 low-risk neighbors

## Behavioral History

Observation history indicates consistent cloud hosting behavior across multiple observation windows. The IP has maintained stable infrastructure characteristics with no significant ownership changes. Recent observations (June 2026) confirm continued OVH cloud compute classification.

## Recommended Actions

Given the high-abuse subnet context and moderate individual risk score, the following defensive measures are recommended:

Firewall Rules:

• `iptables -A INPUT -s 51.89.129.48 -j DROP`
• `nft add rule inet filter input ip saddr 51.89.129.48 drop`
• `nginx: deny 51.89.129.48;`

WAF Rules:

• Cloudflare WAF: Block with expression `ip.src eq 51.89.129.48`
• AWS WAF: Add address `51.89.129.48/32` to rule set

SOC Guidance: Consider blocking traffic from the entire /24 subnet (51.89.129.0/24) due to the 98.5% threat sibling rate, or apply enhanced monitoring to this IP class. The high abuse density suggests coordinated malicious activity within this subnet.

---

*Report generated for defensive security operations. Verify against internal threat intelligence before implementing blocking measures.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.