54.39.203.35📋 Copy

IP Intelligence Briefing: 54.39.203.35

Date: June 14, 2026

---

**1. Risk Assessment**

• Overall Risk Score: 25 (Low Risk / Minimal)
• Provider Score: 0 (No provider risk indicators)
• Authority Score: 0 (No authoritative abuse signals)
• Stability: Unstable (route stability score: 0.2174).
• Threat Indicators: No malware, phishing, or exploit activity detected.

---

**2. Network Context**

• Ownership:

- Registered to Ahrefs Pte Ltd (OVH ASN 16276).

- Subnet: 54.39.203.0/24 (OVH-CUST-281059687).

• Geolocation:

- Registered to Canada (QC, Beauharnois).

- Geo Validation: Inconsistent (RTT of 27ms vs. expected 112.6ms for 5,629km distance).

- Likely a residential or mobile ISP route (no enterprise geolocation match).

---

**3. Observation History**

• Recent Activity (Last 30 Days):

- 14 observations (2026-06-03 to 2026-06-14).

- Risk Trends: Minimal risk score (0.25) consistently.

- Abuse Density: Subnet abuse density 0.4472 (mixed classification).

- Neighbor Risk: 110/246 IPs in subnet flagged as high/medium risk.

---

**4. Network Relationships**

• Linked Entities:

- OVH-CUST-281059687 (same network).

- ahrefs.net (DNS hostname: `proxy-ca008-san35.ahrefs.net`).

• Services: No open ports or TLS certificates detected.
• Routing: BGP prefix 54.39.0.0/16, RPKI valid, IRR inconsistent.

---

**5. Subnet Neighborhood**

• Subnet: 54.39.203.0/24.
• Abuse Density: 0.4472 (44.72% of IPs in subnet flagged as malicious).
• High-Risk Neighbors: 85 IPs (medium risk), 15 IPs (low risk).
• Notable IPs:

- 54.39.203.0/24 (mixed risk).

- 54.39.203.1–4 (40% risk score).

---

**6. Threat Indicators**

• Malicious Activity: None detected (no blacklists, campaigns, or exploit indicators).
• DNS: No malicious domains or email authentication issues.
• SSL/TLS: No certificates or server banners identified.

---

**7. Recommendations**

• Verify Geo Validation: Investigate the discrepancy between registered location (Canada) and traffic patterns (residential/mobile ISP).
• Monitor Subnet: Track high-risk neighbors in 54.39.203.0/24 for potential lateral movement or botnet activity.
• Validate Ownership: Confirm Ahrefs Pte Ltd’s legitimate use of the subnet to rule out spoofing.
• Enable Logging: Monitor DNS and network traffic for unusual behavior in the subnet.

Conclusion: This IP appears to be a legitimate cloud instance from Ahrefs, but its subnet contains a mix of high/medium-risk IPs. Further investigation into the geolocation anomaly and subnet activity is advised.

---

Source: IPDebrief Threat Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.