5.39.109.177📋 Copy

# IP Intelligence Briefing: 5.39.109.177/32

Classification: Moderate Risk | Risk Score: 40 | Provider: OVH (ASN 16276)

## Executive Summary

IP 5.39.109.177 is a cloud hosting address owned by Ahrefs Pte Ltd Dmytro on the OVH infrastructure (ASN 16276). The IP is classified as cloud compute infrastructure with no active services detected (firewalled/no services). Despite the "Moderate Risk" classification and moderate risk score of 40, the IP shows no active threat indicators, is not on major threat feeds, and has zero blacklist hits. However, the IP is hosted in a high-abuse subnet (5.39.109.0/24) with an abuse density of 0.75 and 18 out of 24 sibling IPs flagged as threat sources.

## Technical Profile

Ownership & Routing:

• ASN: 16276 (OVH)
• BGP Prefix: 5.39.0.0/17
• RIR: RIPE
• DNSSEC Valid: Yes
• Has CAA: Yes
• Route Stability: Stable (0 route changes in 30 days)

Geolocation:

• Country: France (FR)
• Region: US-NY (reported)
• Accuracy: ±500km
• Average RTT: 90.8ms
• GeoPlausible: Yes

Network Role:

• Infrastructure Type: CloudCompute
• Is Cloud: Yes
• Is Hosting: Yes
• Connection Type: Firewalled / No Services
• No open ports detected

DNS Resolution:

• PTR Hostname: proxy-fr009-san177.ahrefs.net
• Forward Resolution: proxy-fr009-san177.ahrefs.net
• Forward Confirmed: No
• Domain: ahrefs.net

## Threat Assessment

Threat Indicators:

• Abuse Confidence Score: Not reported
• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No
• Blacklist Count: 0
• DNSBL Listed: 1 of 8 lists
• Known Campaigns: None

Behavioral Signals:

• Honeypot Hits: 0
• Threat Persistence Days: 0
• Persistently Malicious: No
• Campaign Likelihood: None

Control Plane:

• Operator Score: 0.2174 (Minimal)
• Route Changes 30d: 0
• Is Route Stable: Yes
• Is MoAS: No

## Neighborhood Analysis

Subnet: 5.39.109.0/24

Risk Distribution in Subnet:

• High Risk: 0 IPs
• Medium Risk: 9 IPs
• Low Risk: 14 IPs

Multiple neighbors (5.39.109.160, .162, .166, .167, .168, .170, .171, .176, .178, .180, .187, .189, .190) show elevated risk scores of 40.

## Observation History

The IP has 21 recorded observations. Recent signals (as of 2026-06-26) indicate:

• OVH cloud hosting infrastructure
• France-based geolocation with 52% confidence
• ahrefs.net domain resolution
• Minimal operator score
• 20% overall confidence on comprehensive signal assessment

## Relationship Graph

51 relationships detected, primarily tied to the same network (OVH_282114234). The IP is associated with multiple entities sharing the same network infrastructure.

## Recommended Actions

Based on the risk profile, the following firewall rules are recommended:

iptables:

```bash

iptables -A INPUT -s 5.39.109.177 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 5.39.109.177 drop

```

nginx:

```nginx

deny 5.39.109.177;

```

pfSense:

```

5.39.109.177/32

```

Cloudflare WAF:

```json

{

"description": "Block 5.39.109.177 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 5.39.109.177"

}

}

```

AWS WAF:

```json

{

"Addresses": ["5.39.109.177/32"],

"Description": "IPDebrief risk 40"

}

```

## Intelligence Narrative

IP 5.39.109.177 represents a legitimate cloud hosting resource within a high-abuse subnet. While the IP itself shows no active malicious behavior, the surrounding neighborhood (5.39.109.0/24) exhibits significant abuse activity with an abuse density of 0.75. The IP is associated with Ahrefs infrastructure but presents a moderate risk profile due to its hosting environment and proximity to known abuse sources.

Recommended posture: Apply blocking rules at the perimeter layer but monitor for legitimate traffic patterns. The IP's association with ahrefs.net suggests potential legitimate use, yet the high-abuse subnet context warrants defensive blocking. Consider implementing rate limiting or time-based restrictions if the IP is observed in legitimate traffic flows.

Priority: Medium – Block due to

Medium – Block due to high-abuse neighborhood context despite individual IP showing no active threat indicators. Monitor for legitimate Ahrefs-related traffic that may be inadvertently blocked.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.