54.39.136.28📋 Copy

# IP Intelligence Briefing: 54.39.136.28/32

## Executive Summary

IP 54.39.136.28 operates within OVH-hosted cloud infrastructure (ASN 16276) in Beauharnois, Quebec, Canada. The address resolves to proxy-ca002-san28.ahrefs.net and is classified as Moderate Risk (Score: 50). While no direct attack indicators were observed, the IP resides in a high-abuse density subnet with 174 confirmed malicious siblings.

## Key Findings

Network Classification

• Provider: OVH Cloud (Hosting/CloudCompute)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 54.39.136.0/24
• Infrastructure Type: Cloud hosting environment with firewall/no active services detected

Geographic Analysis

• Location: Beauharnois, Quebec, CA
• Validation Status: Flagged - RTT measurement (26ms) contradicts stated distance (5,628.6km), suggesting possible geo-IP spoofing or inaccurate database mapping

Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Listings: 2 of 8 total lists
• Campaign Correlation: None observed

Neighborhood Context

The /24 subnet (54.39.136.0/24) exhibits concerning characteristics:

• Abuse Density: 0.6797 (High Abuse classification)
• Threat Siblings: 174 out of 256 total IPs flagged
• Risk Distribution: 100 medium-risk neighbors, 0 high-risk neighbors
• Inherited Risk Score: 27

Historical Trends

Analysis of 20 observations reveals:

• Consistent OVH cloud/hosting classification
• Persistent high-abuse subnet classification
• Operator score: 0.2174 (Minimal)
• Route stability: Unstable (route changes detected)
• No ownership changes observed

## SOC Action Recommendations

1. Monitor, Don't Block: Moderate risk score with no active threats detected. Implement rate limiting and connection monitoring rather than immediate blocking.

2. Subnet-Side Analysis: Consider blocking or monitoring the broader 54.39.136.0/24 subnet due to 68% abuse density. 174 malicious siblings suggest coordinated malicious activity in this block.

3. DNSBL Verification: Investigate the 2 DNSBL listings for specific blocking criteria.

4. Traffic Pattern Analysis: The geographic validation discrepancy warrants investigation into whether this IP is being used for geo-spoofing purposes.

5. Ahrefs Domain Context: The hostname proxy-ca002-san28.ahrefs.net indicates association with Ahrefs (SEO analytics company). Verify if this is legitimate corporate traffic or compromised infrastructure.

## Risk Assessment

Current Risk Level: MODERATE (50/100)

Primary Concern: Subnet abuse density rather than direct threat indicators

Recommended Action: Monitor with elevated scrutiny; implement subnet-level controls

---

*Intelligence compiled from IPDebrief analysis. Data current as of 2026-06-23.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.