54.39.136.247📋 Copy

## INTELLIGENCE BRIEFING: 54.39.136.247/32

Classification: Moderate Risk | Report Date: Current | Confidence: High

Executive Summary

IP address 54.39.136.247 is a cloud-hosted infrastructure address assigned to Ahrefs Pte Ltd under OVH hosting services (ASN 16276). The address resolved to proxy-ca002-san247.ahrefs.net and is geolocated to Beauharnois, QC, Canada. While the IP itself shows moderate risk (score: 40), the /24 subnet demonstrates elevated abuse density (0.7031), with 180 of 256 sibling IPs flagged as threats.

Technical Profile

Ownership and Infrastructure:

• Organization: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• Network Block: 54.39.136.0/24
• Infrastructure Type: CloudCompute/Hosting
• Connection Status: Firewalled, no open services detected

Geolocation Validation:

• Reported Location: Beauharnois, QC, Canada
• Validation Status: GeoPlausible flag failed
• RTT Discrepancy: Measured 27ms against minimum possible 112.6ms for 5,628km distance
• This suggests potential geolocation spoofing or data inconsistency

DNS and Network Indicators

DNS Resolution:

• PTR Hostname: proxy-ca002-san247.ahrefs.net
• Forward Resolution: 1 record confirmed
• Email Authentication: No SPF, DMARC, or TXT records present

Threat Indicators:

• DNSBL Status: Listed on 1 of 8 total blacklists
• Tor Exit/VPN/Proxy: Negative
• Known Attacker/Spam Source: Negative
• Campaign Association: None detected

Neighborhood Analysis

Subnet Context (54.39.136.0/24):

• Abuse Density: 0.7031 (high_abuse classification)
• Active Siblings: 184 of 256 total IPs
• Threat Siblings: 180 flagged as malicious
• Risk Distribution: 0 high, 38 medium, 62 low risk

The elevated neighborhood abuse density indicates this subnet hosts mixed legitimate and compromised infrastructure, requiring contextual analysis rather than blanket blocking.

Observation History

Temporal Signals:

• Total Observations: 27 events recorded
• Recent Activity: Infrastructure and DNS signals observed June 2026
• Persistence: Not classified as persistently malicious
• Threat Persistence Days: 0

The address has demonstrated stable ownership with no significant threat pattern evolution over the observation period.

Intelligence Assessment

Primary Findings:

1. Legitimate cloud hosting infrastructure for Ahrefs-related services

2. Geo-location data validation failed; RTT anomalies present

3. Subnet exhibits high abuse density (70.3%)

4. No active malicious activity directly associated with this IP

Contextual Considerations:

• The address operates within an OVH-hosted cloud environment
• DNS infrastructure indicates web proxy functionality
• Neighboring IPs show significant abuse correlation (180 threat siblings)
• Blacklist presence (1 of 8 lists) warrants monitoring

Recommendation:

Allow traffic while monitoring for anomalous behavior patterns. The moderate risk score (40) combined with high-density neighborhood suggests contextual filtering may be more appropriate than outright blocking. Implement rate limiting and behavioral monitoring to distinguish legitimate Ahrefs traffic from potential abuse originating from the same subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.