54.39.136.157📋 Copy

## IP Intelligence Briefing: 54.39.136.157

Target IP: 54.39.136.157/32

Risk Assessment: Low Risk (Score: 25/100)

Classification: Mixed-use CloudCompute infrastructure

Ownership & Infrastructure:

The IP address belongs to organization "Dmytro, Ahrefs Pte Ltd" under ASN 16276 (OVH). The address is hosted on OVH's cloud compute infrastructure within the 54.39.136.0/24 block. Geolocation data indicates Canada (QC, Beauharnois), though RTT validation shows anomalies suggesting geolocation data may be inaccurate. DNS PTR records resolve to proxy-ca002-san157.ahrefs.net under the ahrefs.net domain. No open ports or active services were detected; the host appears firewall-configured with no exposed services.

Threat Profile:

The IP maintains a low risk score of 25 with no active threat indicators. No known campaigns, attacker signatures, or spam source indicators were identified. Blacklist status shows 0 direct listings, though the IP appears on 8 DNSBLs with 1 listing at maximum severity. Operator classification is "Minimal" (0.2174 score). Historical observations confirm consistent cloud hosting classification with no evidence of persistent malicious activity.

Neighborhood Analysis:

The 54.39.136.0/24 subnet exhibits mixed classification with an abuse density of 0.4609. Of 256 total siblings, 189 are actively used and 118 are classified as threats. Risk distribution within the subnet shows 0 high-risk, 58 medium-risk, and 42 low-risk addresses. Neighbor IPs (e.g., 54.39.136.0, 54.39.136.1) display risk scores ranging from 25-40 with authority scores of 50.

Network Relationships:

The IP maintains 53 detected relationships, primarily "Same Network" associations with OVH-CUST-281059681. No certificate or hostname relationships beyond the PTR record were identified.

Security Recommendations:

No immediate firewall rules or blocking actions recommended based on current risk profile. The IP demonstrates low-risk characteristics typical of legitimate cloud hosting infrastructure. However, SOC teams should monitor the subnet's elevated abuse density (0.4609) and threat sibling count (118), as mixed-use hosting environments may attract opportunistic threats.

Historical Trend:

Observation history (20 signals) indicates stable characteristics with no significant risk escalation. The IP has not demonstrated persistent malicious behavior patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.