54.39.0.75📋 Copy

# IP Intelligence Briefing: 54.39.0.75/32

Classification: Moderate Risk / Cloud Infrastructure

Date: Current Analysis Period

Status: Active Monitoring Required

---

## Executive Summary

IP 54.39.0.75 is a cloud-hosted infrastructure address registered to OVH-CUST-281059683, associated with Ahrefs Pte Ltd. The IP resolves to a proxy hostname (proxy-ca004-san75.ahrefs.net) with no active open services detected. While associated with a legitimate web analytics vendor, the subnet exhibits elevated abuse characteristics requiring defensive awareness.

---

## Technical Profile

Network Classification:

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Location: Canada (Quebec, Beauharnois)
• Infrastructure Type: CloudCompute
• Hosting Status: Active
• Connection State: Firewalled / No Services Detected

Risk Assessment:

• Overall Risk Score: 40 (Moderate)
• Provider Score: 0 (No provider-level risk)
• Authority Score: 0 (No authority-level risk)
• Operator Score: 0.2174 (Minimal)

---

## Network Neighborhood Analysis

Subnet: 54.39.0.0/24

• Total Siblings: 256
• Active Siblings: 227 (88.7% utilization)
• Threat Siblings: 184 (72.3%)
• Abuse Classification: High Abuse
• Inherited Risk: 28

Risk Distribution in /24:

• High Risk: 0 IPs
• Medium Risk: 33 IPs (12.9%)
• Low Risk: 67 IPs (26.2%)

The subnet demonstrates significant activity density with 184 threat-identified neighbors, indicating concentrated cloud hosting activity typical of OVH infrastructure.

---

## Threat Indicators

Current Status:

• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit: No
• Campaign Association: None
• DNSBL Listings: 1 of 8 total lists

Observation History (22 signals):

• Most Recent Signal: 2026-06-28 (Cloud infrastructure classification, 90% confidence)
• Previous Signal: 2026-06-20 (High abuse subnet classification, 75% confidence)
• Threat Persistence: 0 days
• Is Persistently Malicious: No

---

## DNS Analysis

Resolved Hostname: proxy-ca004-san75.ahrefs.net

• Domain: ahrefs.net
• Forward Resolution: Confirmed (1 hostname)
• Reverse DNS: Present
• Forward Confirmed: No

Email Authentication:

• SPF Record: Not detected
• DMARC Record: Not detected
• TXT Records: 0

---

## Service & Port Analysis

• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: None detected
• Server Banner: None
• Service Purpose: Firewalled / No Services

---

## Recommended Actions

For SOC Analysts:

1. Monitor subnet 54.39.0.0/24 for elevated abuse activity (184 threat siblings identified)

2. No immediate blocking required; risk score of 40 indicates moderate concern

3. Consider traffic analysis if connections originate from this IP to internal resources

4. DNSBL monitoring recommended (1 listing detected)

Firewall Considerations:

• No specific blocking rules recommended at this risk level
• Whitelist consideration if legitimate Ahrefs infrastructure access is required
• Monitor for anomalies given high-abuse subnet context

---

## Conclusions

IP 54.39.0.75 represents cloud-hosted infrastructure associated with Ahrefs web analytics services. The moderate risk classification stems primarily from subnet-level abuse characteristics rather than IP-specific malicious activity. Current threat indicators show no active campaigns or persistent malicious behavior. Continue monitoring given the high-abuse neighborhood context, but no immediate defensive action is required absent additional threat intelligence.

Threat Level: LOW-MODERATE

Recommended Action: MONITOR

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.