5.39.109.160📋 Copy

# IP Intelligence Briefing: 5.39.109.160/32

## Executive Summary

IP address 5.39.109.160 is a cloud-hosted infrastructure endpoint associated with Ahrefs Pte Ltd, operating on OVH cloud compute infrastructure in France. The IP carries a moderate risk score of 40 with no active threat indicators, though it resides within a high-abuse density subnet (5.39.109.160/24). No malicious activity or service exposure was detected during profiling.

## Risk Profile

• Overall Risk Score: 40/100 (Moderate Risk)
• Risk Classification: Moderate Risk
• Infrastructure Type: Cloud Compute (OVH)
• Provider Score: 0
• Authority Score: 0
• Threat Indicators: None detected
• Blacklist Status: 1 DNSBL listing out of 8 total lists

## Ownership & Geolocation

• Organization: Ahrefs Pte Ltd Dmytro
• ASN: 16276 (OVH SAS)
• Geographic Location: France (FR)
• BGP Prefix: 5.39.0.0/17
• Infrastructure Status: Cloud-hosted, no active services detected

## Network Analysis

The IP resolves to hostname proxy-fr009-san160.ahrefs.net as part of Ahrefs' proxy infrastructure. DNS analysis confirms forward resolution to ahrefs.net domain with CAA records present and DNSSEC valid. No open ports or services were detected; the IP is classified as "Firewalled / No Services."

## Neighborhood Assessment

The /24 subnet (5.39.109.160/24) exhibits elevated abuse characteristics:

• Abuse Density: 0.75 (high abuse classification)
• Active Siblings: 14 of 24 total IPs
• Threat Siblings: 18 identified
• Neighbor Risk Distribution: 5 medium-risk (score 25), 18 low-risk (score 25), 3 elevated-risk (score 40)

Notable neighbors include 5.39.109.176, 5.39.109.180, 5.39.109.187, 5.39.109.189, and 5.39.109.190 (all with risk score 40).

## Historical Observations

Analysis of 23 historical observations reveals consistent infrastructure characteristics:

• Persistent cloud hosting classification
• Stable provider (OVH) identification
• Recent activity through June 2026
• No significant risk escalation over time

## Threat Intelligence Assessment

• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No
• Is Proxy/VPN: No
• Known Campaigns: None
• Campaign Likelihood: None

## SOC Recommendations

Current Posture: Monitor with standard scrutiny. The IP represents legitimate Ahrefs infrastructure within an elevated-risk subnet.

Recommended Actions:

1. Allow traffic from this IP if business requires interaction with Ahrefs services

2. Monitor for any service exposure changes or port openings

3. Implement subnet-level monitoring for 5.39.109.160/24 due to high abuse density

4. Consider geo-blocking if the service is not required in the France region

Firewall Rule Consideration: No blocking required based on current threat profile. The moderate risk score reflects subnet context rather than IP-specific malicious activity.

## Conclusion

IP 5.39.109.160 represents legitimate Ahrefs cloud infrastructure. While the parent subnet shows elevated abuse characteristics, this specific endpoint shows no active threat indicators and should be treated as a legitimate service host requiring standard operational monitoring rather than threat mitigation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.