54.39.0.105📋 Copy

## IP Intelligence Briefing: 54.39.0.105/32

Executive Summary

IP address 54.39.0.105 is a cloud-hosted address owned by Dmytro, Ahrefs Pte Ltd, operating on OVH infrastructure (AS16276). The IP carries a moderate risk score of 40 and is classified as high-abuse within its subnet. No active threat indicators were observed, but the subnet's abuse density warrants monitoring.

Profile Details

• Risk Score: 40 (Moderate Risk)
• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• Network Block: 54.39.0.0/16
• Geolocation: Beauharnois, QC, CA (geolocation validation failed—RTT 26ms inconsistent with 5,629km claimed distance)
• Infrastructure Type: CloudCompute/Hosting
• Network Role: Firewalled / No Services Detected

DNS and Hostname Intelligence

• PTR Record: proxy-ca004-san105.ahrefs.net
• Domain Association: ahrefs.net
• Forward Resolution: 1 hostname
• Email Authentication: No SPF or DMARC records configured

Neighborhood Analysis

The /24 subnet (54.39.0.0/24) shows elevated abuse characteristics:

• Abuse Density: 0.6953 (high classification)
• Active Siblings: 220 of 256 total IPs
• Threat Siblings: 178 IPs flagged as threats
• Neighbor Risk Distribution: 98 medium-risk, 2 low-risk, 0 high-risk IPs

Historical Observations

26 observations recorded over the analysis period. Signals include:

• Consistent geolocation anomalies (RTT violations)
• Persistent hosting classification
• No significant risk escalation trends
• Average ownership duration insufficient to establish persistence patterns

Threat Indicators

• Known Campaigns: None
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Pulsedive Risk: Not assessed

Recommended Security Actions

Based on risk profile, the following firewall rules are recommended:

iptables: `iptables -A INPUT -s 54.39.0.105 -j DROP`

nftables: `nft add rule inet filter input ip saddr 54.39.0.105 drop`

nginx: `deny 54.39.0.105;`

Cloudflare WAF: Block expression `ip.src eq 54.39.0.105`

AWS WAF: Address `54.39.0.105/32`

Intelligence Notes

The IP is associated with the ahrefs.net domain namespace but shows no open services. The high abuse density of the parent subnet (0.6953) combined with 178 threat siblings suggests this /24 may be compromised or misused. While no active threat indicators were observed, the moderate risk score and neighborhood context warrant defensive blocking. The geolocation discrepancy (RTT violation) indicates potential spoofing or misrepresentation.

Classification: Moderate Risk / Monitor

Confidence Level: Medium (geolocation validation failed)

Recommended Action: Block with logging enabled

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.