51.89.129.94📋 Copy

# IP Intelligence Briefing: 51.89.129.94/32

## Executive Summary

IP 51.89.129.94 is a cloud-based infrastructure endpoint operated by OVH (ASN 16276) on behalf of Ahrefs Pte Ltd Dmytro. The IP is located in London, England and resolves to aresolves to the hostname proxy-uk008-san94.ahrefs.net. Current risk assessment indicates Moderate Risk (Score: 40). No active threat indicators, campaigns, or malicious activity observed.

## Ownership and Infrastructure

• ASN: 16276 (OVH SAS)
• Organization: Ahrefs Pte Ltd Dmytro
• Infrastructure Type: CloudCompute (OVH hosting)
• Geolocation: London, England, GB (GeoSource: 1, Consensus: True, Plausible: True)
• Network Classification: Cloud infrastructure, Hosting service
• DNS: proxy-uk008-san94.ahrefs.net (Forward confirmed: Yes)
• Services: No open ports detected (Firewalled/No Services)

## Threat Assessment

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence Score: Not available
• Blacklist Status: 0 blacklist hits
• Known Campaigns: None detected
• Threat Indicators: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

## Control Plane Analysis

• BGP Prefix: 51.89.0.0/16
• Route Stability: Not stable (route changes observed)
• DNSSEC Valid: Yes
• DNSBL Listings: 1 of 8 lists (dnsblListedCount)
• Operator Score: 0.2174 (Minimal)

## Neighborhood Analysis (51.89.129.0/24)

• Abuse Density: 0.7422 (High Abuse classification)
• Inherited Risk: 29
• Subnet Siblings: 256 total, 194 active, 190 threat siblings
• Risk Distribution: 0 High, 64 Medium, 36 Low risk neighbors
• Note: The subnet exhibits elevated abuse activity, though this IP specifically shows no malicious indicators.

## Observation History (22 Signals)

• Most Recent: 2026-06-28T06:45:52 - Subnet analysis: abuse_density 0.4023, classification: mixed
• Previous: 2026-06-20T04:42:04 - Subnet analysis: abuse_density 0.7422, classification: high_abuse
• Geolocation Confirmed: GB (confidence: 0.28)
• Threat Persistence Days: 0
• Is Persistently Malicious: No

## Relationships

• Network Relationships: 46 relationships identified (same network: OVH_282347344)
• No Correlated Campaigns: 0 correlated IPs, 0 cert matches, 0 banner matches

## Recommended Actions

1. Standard Monitoring: Monitor for unusual outbound patterns from this endpoint

2. Subnet Awareness: Be aware that the /24 subnet (51.89.129.0/24) shows elevated abuse density (0.7422)

3. No Block Required: No immediate blocking recommended; IP is legitimate cloud infrastructure

4. DNS Verification: Forward resolution confirmed to ahrefs.net domain

5. Firewall Rule: No specific firewall rules generated (no threat indicators)

## Conclusion

This IP represents legitimate cloud infrastructure for Ahrefs. While the hosting subnet demonstrates elevated abuse characteristics, this specific endpoint shows no malicious activity. SOC teams should monitor the subnet generally but treat the IP as benign unless new threat indicators emerge. No immediate defensive action required.

Classification: Moderate Risk - Cloud Infrastructure Endpoint

Priority: Low

Action: Monitor

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.