54.39.136.143📋 Copy

IP Intelligence Briefing: 54.39.136.143

Date: 2026-06-15

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Ownership:

- ISP: OVH (ASN 16276)

- Organization: Ahrefs Pte Ltd (netname: OVH-CUST-281059681)

- Geolocation: Canada (QC, Beauharnois), inferred via DNS (latitude: 45.3161, longitude: -73.8736).

• Network Role:

- Cloud infrastructure (OVH-hosted), no services detected (open ports/tls/http).

- DNS: Resolves to `proxy-ca002-san143.ahrefs.net` (ahrefs.net domain).

---

**2. Threat Indicators**

• No direct malicious indicators (no malware, spam, or known attacker activity).
• Geolocation Anomalies:

- RTT violation detected (27ms vs. expected 112.6ms for 5629km distance), suggesting potential spoofing or residential/mobile ISP misattribution.

- Geolocation validation failed (geo_plausible: false).

• DNS Security:

- DNSSEC valid, CAA records present, but no SPF/DMArc configured for `ahrefs.net`.

---

**3. Network Behavior**

• Subnet Context:

- Part of 54.39.136.0/24 (OVH subnet).

- Subnet abuse density: 0.5433 (high abuse classification).

- 138/254 siblings in subnet flagged as malicious (138 threat siblings).

• Neighbor Risk:

- Subnet contains 89 medium-risk and 11 low-risk IPs.

- Neighbors include IPs with risk scores up to 50 (e.g., 54.39.136.0).

---

**4. Temporal Observations**

• Recent Activity (Last 30 Days):

- 18 observations:

- 1 RTT anomaly (June 15, 2026).

- 1 DNS resolution for `ahrefs.net` (June 9, 2026).

- 16 geo/abuse signals (e.g., subnet abuse density, operator risk score).

- No persistent malicious activity detected.

---

**5. Recommendations**

• Monitor Subnet:

- The 54.39.136.0/24 subnet has high abuse density; investigate traffic patterns and potential lateral movement.

• Verify Geolocation:

- Investigate the RTT anomaly and geo_plausible flag. This IP may be misattributed or part of a spoofing campaign.

• Secure DNS:

- Enable SPF/DMArc for `ahrefs.net` to mitigate email spoofing risks.

• Network Segmentation:

- Consider isolating high-risk siblings in the subnet (e.g., 54.39.136.0, 54.39.136.1) if they are not critical assets.

---

Conclusion:

This IP is associated with a legitimate cloud provider (OVH) and appears to be a legitimate Ahrefs server. However, the subnet's high abuse density and geolocation anomalies warrant further investigation. SOC teams should monitor for unusual traffic patterns and validate the IP's true origin.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.