54.39.136.197📋 Copy

# IP Intelligence Briefing: 54.39.136.197/32

Date: Intelligence compiled from IPDebrief

IP Address: 54.39.136.197

Risk Classification: Moderate Risk (Score: 50/100)

## Executive Summary

IP 54.39.136.197 is an OVH CloudCompute infrastructure address associated with Ahrefs Pte Ltd (ASN 16276). The IP is located in Beauharnois, Quebec, Canada, and operates within a high-abuse subnet (54.39.136.0/24) with an abuse density of 0.7031. The address shows no direct threat indicators but inherits significant risk from its neighborhood environment.

## Ownership and Infrastructure

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH SAS)
• CIDR Block: 54.39.136.0/24
• Infrastructure Type: CloudCompute (OVH hosting)
• Registration: ARIN RIR

## Geolocation

• Country: Canada (CA)
• Region: Quebec (QC)
• City: Beauharnois
• Geo Confidence: Consensus across multiple sources (geoConsensus: true)

## Network Classification

• Provider: OVH
• Services: Firewalled/No Services (no open ports detected)
• CDN/Proxy/VPN: No
• Tor Exit Node: No
• Mobile/Residential: No

## DNS Analysis

• PTR Hostname: proxy-ca002-san197.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed (1 hostnames)
• Email Authentication: No SPF or DMARC records present
• DNSBL Listings: 2 out of 8 total lists

## Threat Indicators

• Known Campaigns: None detected
• Threat Feeds: No matches
• Blacklist Status: Clean (0 blacklists)
• Abuse Confidence Score: Not calculated

## Neighborhood Analysis (54.39.136.0/24)

• Total Siblings: 256 IPs
• Active Siblings: 184
• Threat Siblings: 180
• Abuse Density: 0.7031 (High)
• Inherited Risk Score: 28
• Risk Distribution: 28 medium risk, 72 low risk

## Temporal History

Observations from June 2026 show:

• June 20: Abuse density 0.7031, classification "high_abuse", inherited risk 28
• June 28: Abuse density decreased to 0.4219, classification "mixed", inherited risk 16
• Geolocation: Consistent Canada attribution with 3000km accuracy radius

## Security Recommendations

Action Status: Block recommended based on moderate risk score and high-abuse subnet environment.

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 54.39.136.197 -j DROP

# nftables

nft add rule inet filter input ip saddr 54.39.136.197 drop

# nginx

deny 54.39.136.197;

# Cloudflare WAF

Expression: ip.src eq 54.39.136.197

Action: block

# AWS WAF

Address: 54.39.136.197/32

```

## Intelligence Assessment

The IP addresses moderate risk score (50) stems primarily from subnet-level abuse characteristics rather than direct malicious activity. The address resolves to an Ahrefs-related hostname but operates within an OVH hosting environment with high abuse density (0.7031). The 180 threat siblings in the /24 subnet indicate this is a shared hosting environment where abuse may originate from neighboring addresses.

Threat Level: Moderate (Inherited from neighborhood)

Recommended Action: Block at perimeter firewall

Monitoring: Monitor for changes in threat indicators or blacklist status

Analyst Notes: While the IP shows no direct threat signatures, the high-abuse neighborhood classification warrants defensive blocking. The DNSBL listings (2/8) and email authentication gaps (no SPF/DMARC) suggest the address may be used for email-related abuse. The subnet's high threat sibling count (180/256) indicates this is a known abuse source range.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.