54.39.210.110📋 Copy

# IP Intelligence Briefing: 54.39.210.110/32

## Executive Summary

IP 54.39.210.110 is a cloud-based hosting resource (OVH Canada) associated with the ahrefs.net domain. The IP demonstrates moderate risk (score 40) primarily due to high-abuse density in its /24 subnet rather than intrinsic malicious activity. No active threat indicators detected on the IP itself.

## Ownership and Infrastructure

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 54.39.210.0/24
• Infrastructure Type: CloudCompute / Hosting
• Geolocation: Beaucharnois, Quebec, Canada (CA)
• RTT Validation: GEO validation shows 5629km distance with 28ms RTT, indicating reported location may be inaccurate or cached

## Threat Profile

• Risk Score: 40 (Moderate Risk)
• Blacklist Status: 0 blacklists; 1 of 8 DNSBL lists
• Known Threats: Not a Tor exit node, not a known attacker, not a spam source
• Network Role: No open services; firewalled/no services detected
• Campaign Correlation: No active campaign matches or correlated IPs detected

## Neighborhood Analysis

The IP resides in a high-risk subnet (54.39.210.0/24):

• Abuse Density: 0.7344 (High Abuse Classification)
• Total Siblings: 256 IPs
• Active Siblings: 172 (67% utilization)
• Threat Siblings: 188 (73% of active siblings flagged)
• Inherited Risk Score: 29

This elevated neighborhood risk stems from shared infrastructure hosting multiple entities, consistent with OVH's multi-tenant cloud model.

## Observed Services and DNS

• PTR Hostname: proxy-ca007-san110.ahrefs.net
• Forward Resolution: proxy-ca007-san110.ahrefs.net
• Associated Domain: ahrefs.net (SEO analytics tool provider)
• Open Ports: None detected
• TLS Certificate: None detected
• Email Authentication: SPF and DMARC records not configured on associated domain

## Observation History

• Total Observations: 24 signals
• Route Stability: Stable (0 changes in 30 days)
• ASN Age: 9,251 days (legacy allocation since 2001-02-15)
• Ownership Changes: 0
• Threat Persistence: 0 days (not persistently malicious)
• Last Observed: June 2026

## Relationship Graph

• Network Relationships: Multiple associations to OVH-CUST-281059686
• Subnet Classification: High abuse density inherited from neighborhood

## Recommended Actions

Based on risk profile and neighborhood context, the following controls are recommended:

Immediate Actions:

```bash

# iptables

iptables -A INPUT -s 54.39.210.110 -j DROP

# nftables

nft add rule inet filter input ip saddr 54.39.210.110 drop

# Cloudflare WAF

ip.src eq 54.39.210.110 → block

```

Contextual Assessment: While the IP itself shows no direct threat indicators, the high-abuse density of the parent subnet (54.39.210.0/24) warrants consideration of broader subnet-level filtering if threat tolerance is low. The association with ahrefs.net (legitimate SEO tool provider) suggests this may be legitimate infrastructure, but the hosting environment hosts multiple entities.

## Analyst Notes

• Legitimate use case: DNS proxy for ahrefs.net
• Primary risk factor: High-abuse neighborhood (188 threat siblings in /24)
• No evidence of active exploitation or command-and-control activity
• Consider monitoring subnet-level trends if observing similar risk patterns across related infrastructure

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.