5.39.1.230📋 Copy

# IP Intelligence Briefing: 5.39.1.230/32

Classification: Moderate Risk – Cloud Infrastructure

Date: 2026-06-28

Analyst: IPDebrief Intelligence

## Executive Summary

IP 5.39.1.230 is a French-based cloud hosting address operating within the OVH infrastructure provider network (ASN 16276). The IP exhibits a risk score of 40 (Moderate Risk) and is associated with Ahrefs Pte Ltd Dmytro organization. The address is registered under the Ripe registry and operates within a /17 BGP prefix (5.39.0.0/17).

## Technical Profile

• IP Address: 5.39.1.230
• Risk Score: 40 (Moderate Risk)
• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH)
• Country: France (FR)
• Infrastructure Type: CloudCompute, Hosting
• Network Classification: Firewalled / No Services
• DNS PTR: proxy-fr005-san230.ahrefs.net
• Forward Resolution: ahrefs.net

## Threat Indicators

• Blacklist Status: Listed on 1 DNS blacklist out of 8 total lists
• DNSBL Listed: Yes (1 count)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: None detected
• Operator Score: 0.2174 (Minimal)
• Abuse Confidence Score: Not available

## Neighborhood Analysis

The IP resides within subnet 5.39.1.0/24, which demonstrates elevated abuse characteristics:

• Subnet Abuse Density: 0.875 (classified as high_abuse)
• Total Siblings: 32
• Active Siblings: 13
• Threat Siblings: 28
• Inherited Risk Score: 35

Risk distribution across neighboring IPs shows 0 high-risk, 25 medium-risk, and 6 low-risk addresses. Multiple sibling IPs (5.39.1.227, 5.39.1.233, 5.39.1.240, 5.39.1.248) exhibit risk scores of 65.

## Historical Observations

The IP generated 26 observations over the monitoring period. Key observations include:

• Recent DNS resolution to proxy-fr005-san230.ahrefs.net with CAA records present
• 2 out of 8 total blacklist listings detected in recent observations
• Maximum severity level: high
• Threat observation count: 1
• The address is not classified as persistently malicious

## Network Control Plane

• Origin ASN: 16276
• BGP Prefix: 5.39.0.0/17
• RPKI State: Not available
• IRR Consistency: Not available
• Route Stability: Not stable (route changes observed)
• DNSSEC Valid: Yes
• CAA Records: Present

## Recommended Actions

Based on the risk profile, the following firewall and filtering rules are recommended:

```bash

# iptables

iptables -A INPUT -s 5.39.1.230 -j DROP

# nftables

nft add rule inet filter input ip saddr 5.39.1.230 drop

# nginx

deny 5.39.1.230;

# pfSense

5.39.1.230/32

# Cloudflare WAF

Block 5.39.1.230 — IPDebrief risk score 40

# AWS WAF

Addresses: 5.39.1.230/32

Description: IPDebrief risk 40

```

## Intelligence Assessment

The IP address operates as a cloud hosting resource within OVH infrastructure in France. While the individual address carries a moderate risk score of 40, the parent subnet (5.39.1.0/24) demonstrates significant abuse density (0.875) with 28 of 32 sibling IPs flagged as threats. The address is associated with legitimate hosting infrastructure (ahrefs.net) but has been observed on DNS blacklists. The presence of multiple high-risk neighbors in the immediate subnet suggests potential collateral risk from neighboring resources.

Recommendation: Apply blocking controls at the firewall perimeter, particularly given the high abuse density of the parent subnet. Monitor for any changes in geolocation or service behavior that may indicate abuse migration patterns within the OVH cloud environment.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.