5.39.109.189📋 Copy

IP Intelligence Briefing: 5.39.109.189

Date: 2026-06-01

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Ownership:

- ASN: 16276 (OVH)

- Organization: Ahrefs Pte Ltd Dmytro

- Network: OVH_282114234 (5.39.109.160/27)

• Geolocation:

- Country: France (FR)

- City: Singapore (likely misattributed or inferred)

- Timezone: Europe/Paris

- Accuracy Radius: 500 km

• Threat Indicators:

- No direct malicious indicators (no blacklists, campaigns, or spam).

- Subnet Abuse Density: 70.83% (high abuse classification).

- Neighbor Risk: 28 inherited risk score from subnet.

---

**2. Network Behavior**

• Infrastructure:

- Cloud Compute: Hosted by OVH (cloud provider).

- Services: No open ports or TLS certificates detected.

• Subnet Analysis:

- /24 Subnet: 5.39.109.189/24

- Total Siblings: 24 IPs | Active Siblings: 5 | Threat Siblings: 17

- Abuse Density: 70.83% (high risk).

- Neighbors: 23 IPs in subnet, most with risk scores ≥40.

---

**3. Historical Observations**

• Recent Activity (2026-06-01):

- No persistent threats or malicious behavior.

- Threat Persistence: 0 days | Threat Observations: 0.

- Stability: Unstable routing (route changes detected).

- Geolocation Inference: Confirmed as France (FR) with 500 km accuracy.

---

**4. Relationships & Dependencies**

• DNS Associations:

- Resolves to `proxy-fr009-san189.ahrefs.net` (Ahrefs Pte Ltd).

• Network Links:

- Part of OVH’s 5.39.109.160/27 subnet.

- BGP Prefix: 5.39.0.0/17 (OVH).

• Operator Risk Score: 0.2174 (Minimal).

---

**5. Recommendations**

• Monitor Subnet: High abuse density in 5.39.109.189/24 warrants closer scrutiny.
• Check Hostname: Investigate `proxy-fr009-san189.ahrefs.net` for potential misuse.
• Firewall Actions: Consider blocking or rate-limiting traffic from this subnet if suspicious activity is detected.
• Geolocation Verification: Validate the "Singapore" city attribution, as it conflicts with the French ISP (OVH).

---

Conclusion:

This IP is part of a high-risk subnet associated with OVH’s cloud infrastructure. While no direct malicious activity is detected, the subnet’s abuse density and inferred geolocation anomalies suggest potential operational risks. SOC teams should prioritize monitoring this subnet for unusual behavior.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.