51.89.9.178📋 Copy

# IP Intelligence Briefing: 51.89.9.178/32

## Executive Summary

IP 51.89.9.178 presents moderate risk (score: 55/100) and is associated with hosting provider OVH BV (ASN 16276) in Berlin, NL. The IP resolves to nubokado.com with a DMARC configuration in place. No active services are detected; the IP is classified as firewalled with no open ports.

## Risk Profile

• Overall Risk Score: 55/100 (Moderate Risk)
• Provider Classification: OVH (Cloud Compute/Hosting)
• Infrastructure Type: Cloud hosting environment
• Reputation: Moderate Risk
• Stability Label: Unstable (null stability score)

## Geolocation & Ownership

• Country: Netherlands (NL)
• City: Berlin
• ASN: 16276 (OVH BV)
• Network Block: 51.89.0.0/16
• Registration Authority: ARIN
• Contact: Abuse contact available via RDAP

## Network Role & Services

• Infrastructure: Cloud hosting provider (OVH)
• Connection Type: Cloud infrastructure
• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None

## DNS Intelligence

• Reverse DNS (PTR): info15.nubokado.com
• Forward Resolution: nubokado.com → info15.nubokado.com
• Forward Confirmed: False
• DMARC: Present (policy: reject)
• SPF: Not configured
• TXT Records: 0
• Hosted Domains: 0

## Threat Indicators

• DNSBL Listings: 3 of 8 total lists (high severity noted)
• Known Tor Exit: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not available
• Campaign Likelihood: Not assessed
• Cert Matches: 0

## Control Plane Data

• RPKI State: Not available
• Route Changes (30d): 0
• Route Stability: False
• DNSSEC Valid: Yes
• Has CAA: No
• DNSBL Listed Count: 3
• Operator Score: 0.2609 (Basic)

## Neighborhood Analysis

• Subnet: 51.89.9.0/24
• Abuse Density: 0.5 (moderate)
• Classification: Mostly clean
• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 1
• High Risk Neighbors: 0
• Medium Risk Neighbors: 1 (51.89.9.181, risk score: 55)

## Historical Observations

21 total observations recorded. Key events include:

DMARC configuration was present on June 15, 2026, but removed by June 20, 2026. DNSBL listings were observed on June 15 with high severity classifications.

## Relationships

• DNS Associations: info15.nubokado.com (repeated)
• Network Associations: OVH-DEDICATED-FO

## Recommended Actions

Priority: Increase Monitoring

• Action: Increase logging verbosity and review recent activity
• Severity: High (risk score 55/100)

Firewall Rules (Block Recommendation)

## Analyst Notes

This IP is part of a low-density hosting environment with one adjacent high-risk neighbor (51.89.9.181). The DMARC policy removal in the last week is notable and may indicate misconfiguration or infrastructure changes. The three DNSBL listings with high severity warrant investigation, particularly in the context of the DMARC policy change. No evidence of active scanning or exploitation was observed. The IP should be monitored for any changes in DNSBL status or service activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.