54.39.210.203
Threat Intelligence Briefing for IP Address 54.39.210.203/32
Date: 2026-06-11
**Key Findings**
1. Ownership & Network:
- Provider: OVH (AS16276), netname *OVH-CUST-281059686*
- Organization: Dmytro, Ahrefs Pte Ltd (hosted infrastructure)
- Geolocation: Canada (QC, Beauharnois), latitude 45.3161, longitude -73.8736
- Network Role: CloudCompute, hosted by OVH, no direct threat indicators.
2. Threat & Risk Profile:
- Risk Score: 40 (Moderate Risk)
- Subnet Abuse Density: 50.99% (high_abuse classification)
- Neighbor Risk: 94/100 IPs in the 54.39.210.0/24 subnet are medium-risk, 5 are low-risk.
- No Direct Threats: No malicious indicators, spam, or known attacker associations.
3. DNS & Hosting:
- PTR Hostname: *proxy-ca007-san203.ahrefs.net* (linked to Ahrefs Pte Ltd).
- Hosting: Likely a proxy or cloud service, no open ports or TLS certificates detected.
4. Observation History:
- Stability: Route stability score is 0 (unstable), with 17 hops in traceroute.
- Consistency: No significant changes in risk or ownership over the past 30 days.
5. Network Relationships:
- Subnet: 54.39.210.0/24 (OVH-managed).
- Linked Entities: DNS association with *proxy-ca007-san203.ahrefs.net*; no other notable relationships.
**Recommendations**
- Monitor Subnet: The 54.39.210.0/24 subnet has high abuse density. Investigate neighboring IPs for potential lateral movement or botnet activity.
- Network Segmentation: Ensure segmentation between cloud-hosted services (OVH) and internal networks.
- DNS Monitoring: Track DNS resolution for *proxy-ca007-san203.ahrefs.net* for unusual activity.
- Firewall Rules: Consider blocking traffic from this subnet if it aligns with known malicious patterns.
Conclusion: The IP is part of a cloud-hosted network with no direct malicious activity. However, the subnet’s high abuse density warrants closer monitoring to mitigate potential risks.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Dmytro, Ahrefs Pte Ltd |
| ASN | AS16276 |
| Network Name | OVH-CUST-281059686 |
| CIDR Block | 54.39.210.0/24 |
| RIR | ARIN |
| Country | Singapore |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | proxy-ca007-san203.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-ca007-san203.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 19% | 2 | 2 |
| ownership | 19% | 2 | 2 |
| reputation | 13% | 1 | 2 |
| geolocation | 24% | 2 | 3 |
| Overall | 20% | 10 | 13 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-29 18:15:20 UTC |
| Last Seen | 2026-06-29 06:48:28 UTC |
| Profile Built | 2026-06-29 06:56:25 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 23 |
Full dossier details are available via our API.