51.91.177.13📋 Copy

IP INTELLIGENCE BRIEFING: 51.91.177.13

Classification: Moderate Risk (Score: 55/100)

Classification Date: Current Assessment

Data Sources: IPDebrief Intelligence Platform

---

**Ownership & Infrastructure**

• Organization: OVH Hosting Limited (ASN: 16276)
• Network Block: 51.91.0.0/16 (BGPPrefix: 51.91.0.0/16)
• Infrastructure Type: Cloud Compute / Hosting Infrastructure
• Geolocation: Ireland (IE), Dublin timezone
• Service Purpose: Single-Service Host

**Technical Profile**

• DNS Resolution: info13.nuboshige.com (Forward confirmed)
• Open Services: SSH (Port 22/TCP) - OpenSSH_10.0p2 Debian-7
• TLS Certificate: Not detected
• HTTP Services: None detected

**Threat Indicators**

• Blacklist Status: Listed on 3 of 8 DNSBLs
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Correlation: None detected

**Subnet Analysis (51.91.177.0/24)**

• Abuse Density: 33.33%
• Total Siblings: 3
• Threat Siblings: 1 (51.91.177.11 - Risk: 55)
• Active Siblings: 1
• Classification: Mostly Clean

**Observation History**

• Total Observations: 24
• Recent Activity: June 2026
• Threat Persistence: 0 days
• Ownership Changes: 0 (Stable)
• Threat Observation Count: 1

**Security Recommendations**

Immediate Actions:

1. Block at Edge: Deploy drop rules for 51.91.177.13/32

2. Enhanced Logging: Increase verbosity for traffic from this IP

3. Monitor Subnet: Watch sibling IPs 51.91.177.11 and 51.91.177.30 (both risk: 55)

Firewall Rules:

• iptables: `iptables -A INPUT -s 51.91.177.13 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 51.91.177.13 drop`
• Cloudflare WAF: Block with expression `ip.src eq 51.91.177.13`
• AWS WAF: Add to block list as `51.91.177.13/32`

Context:

The elevated risk score (55) is primarily attributed to the IP's classification as hosting infrastructure rather than confirmed malicious activity. The subnet shows moderate abuse density with one confirmed threat sibling. No persistent malicious behavior has been observed. Enhanced monitoring recommended due to DNSBL listings and hosting infrastructure role.

Analyst Note: Verify against internal threat intelligence before implementing blocking. Consider geographic-based analysis if traffic originates from non-business locations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.