54.37.252.36📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

## Target: 54.37.252.36/32

EXECUTIVE SUMMARY

The IP address 54.37.252.36 is a cloud compute infrastructure endpoint owned by OVH SAS, located in France. The asset carries a moderate risk score (50/100) with no active threat indicators. The IP hosts an SSH service on port 22 and resolves to hostname ns3114111.ip-54-37-252.eu. While the individual IP shows no malicious activity, its /24 subnet exhibits elevated abuse density (0.5714), indicating potential collateral risk from neighboring addresses.

---

NETWORK OWNERSHIP & GEOGRAPHY

• Organization: OVH SAS
• ASN: 16276
• Country: France (FR)
• Infrastructure Type: Cloud Compute / Hosting
• BGP Prefix: 54.37.0.0/16
• Route Stability: Unstable (isRouteStable: false)

THREAT ASSESSMENT

Threat Indicators: None detected. No known campaigns, threat feeds, or abuse confidence scores associated with this IP.

NETWORK SERVICES & FINGERPRINT

• Open Ports: TCP/22 (SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.15)
• DNS: ns3114111.ip-54-37-252.eu (forward resolved)
• TLS Certificate: None
• HTTP Content: None
• Email Auth: SPF configured, DMARC absent

NEIGHBORHOOD ANALYSIS (54.37.252.0/24)

The /24 subnet shows elevated abuse characteristics requiring contextual monitoring:

• Abuse Density: 0.5714 (High)
• Subnet Classification: high_abuse
• Total Siblings: 14
• Active Siblings: 10
• Threat Siblings: 8

Neighbor Risk Distribution:

• High Risk (50+): 1 IP (54.37.252.231)
• Medium Risk (25-49): 9 IPs
• Low Risk (<25): 4 IPs

Key neighboring addresses requiring attention: 54.37.252.231 (risk 50), 54.37.252.46/59/118/119/130/152/153/229 (risk 40).

OBSERVATION HISTORY

• Total Observations: 23 signals
• Threat Persistence: 0 days
• Recent Activity: Neighborhood classification observed 2026-06-19
• Status: Not persistently malicious

RELATIONSHIP GRAPH

The IP maintains 50 recorded relationships, primarily:

• DNS associations to ns3114111.ip-54-37-252.eu
• Network membership: SD-1G-GRA2
• No certificate or hostname correlation beyond DNS

RECOMMENDED ACTIONS

Based on risk profile (50), the following defensive measures are recommended:

Note: These recommendations are probabilistic. Correlate with additional signals before enforcement.

SOC ANALYST NOTES

1. Low Immediate Threat: The IP itself shows no active malicious behavior. Blocking may impact legitimate OVH cloud services.

2. Subnet Context: The 54.37.252.0/24 subnet shows high abuse density. Consider evaluating 54.37.252.231 (risk 50) for additional threat context.

3. Infrastructure Type: As a cloud hosting endpoint, this IP may be legitimately used for web hosting, development, or legitimate services.

4. SSH Exposure: Port 22 is open; ensure SSH traffic is not being abused for lateral movement attempts.

5. DNSBL Listings: 2 of 8 total lists flag this IP; investigate specific list contents if receiving complaints.

---

*Report generated: 2026-06-26 | Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.