5.39.109.190📋 Copy

## Intelligence Briefing: IP 5.39.109.190/32

**Executive Summary**

IP 5.39.109.190 is a cloud infrastructure endpoint operated by OVH under Ahrefs Pte Ltd Dmytro ownership. Current risk assessment places this address at Moderate Risk (Score: 40) with classification as CloudCompute/Hosting infrastructure. The endpoint serves as a firewall with no active services, but the /24 subnet demonstrates elevated abuse density requiring monitoring.

---

**Ownership & Infrastructure Profile**

• Provider: OVH (ASN 16276)
• Network: OVH_282114234
• CIDR Block: 5.39.109.160/27
• Registration: RIR RIPE
• Infrastructure Type: CloudCompute (Hosting)
• Classification: Firewalled/No Services

**Geolocation Analysis**

Multiple geolocation sources indicate Singapore with Europe/Paris timezone, though geo validation flags show geoPlausible=false. The address appears on 1 of 8 DNS blacklists (dnsblListedCount:1). Traceroute analysis reveals 19 hops with Comcast transit networks.

**DNS & Hostname Intelligence**

• PTR Hostname: proxy-fr009-san190.ahrefs.net
• Forward Resolution: Confirmed to ahrefs.net
• Forward Hostnames: 1 hostname (proxy-fr009-san190.ahrefs.net)
• Domain: ahrefs.net

The DNS association correlates with Ahrefs infrastructure, an SEO analytics company.

---

**Threat Indicators & Risk Assessment**

Current Risk Score: 40 (Moderate)

Abuse Density (Neighborhood): 0.75 (High)

Inherited Risk: 30

---

**Network Neighborhood Analysis**

The /24 subnet (5.39.109.0/24) contains 24 total sibling IPs with 14 active siblings. Risk distribution shows:

• High Risk: 0 neighbors
• Medium Risk: 2 neighbors
• Low Risk: 21 neighbors

Notable Neighbors:

• 5.39.109.180: Risk Score 40 (Authority: 50)
• 5.39.109.189: Risk Score 40 (Authority: 50)
• 5.39.109.160: Risk Score 0 (Authority: 50)

Subnet Classification: High abuse density observed in historical data.

---

**Historical Activity Timeline**

23 total observations recorded:

Key Observations:

• June 21, 2026: IP was flagged in a high-abuse environment with 18 threat siblings and 0.75 abuse density
• June 29, 2026: Abuse density decreased to 0.2917 with mixed classification and 7 threat siblings
• No persistent malicious activity detected (threatPersistenceDays: 0)

---

**Network Relationships**

• Same Network: Multiple associations to OVH_282114234
• DNS Associations: proxy-fr009-san190.ahrefs.net (13 relationship entries)
• Infrastructure Correlation: Strong correlation with Ahrefs operational infrastructure

---

**Recommended Actions**

Current Status: LOW THREAT (Monitor)

• No active threat indicators
• No open ports detected
• No known campaigns or certificates associated

Monitoring Recommendations:

1. Traffic Monitoring: Maintain baseline traffic monitoring for this IP due to moderate risk score (40)

2. Neighborhood Awareness: Monitor sibling IPs 5.39.109.180 and 5.39.109.189 (also Risk Score 40)

3. DNS Watch: Monitor proxy-fr009-san190.ahrefs.net for any behavioral anomalies

4. Geolocation Verification: Re-evaluate geolocation accuracy given Singapore/France conflict

Firewall/Blocking Decision:

• Recommendation: Allow with logging
• Rationale: Legitimate corporate infrastructure (Ahrefs), no active threat indicators, moderate risk score acceptable for cloud hosting environment

Priority Level: LOW-MEDIUM

Intelligence Confidence: HIGH (multiple data sources confirm)

Last Updated: 2026-06-29

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.