54.39.6.115📋 Copy

# IP INTELLIGENCE BRIEFING: 54.39.6.115/32

Date: 2026-06-28

Analyst: IPDebrief Intelligence

Classification: MODERATE RISK

## EXECUTIVE SUMMARY

IP address 54.39.6.115/32 is hosted on OVH cloud infrastructure (ASN 16276) with a moderate risk score of 40. The subnet (54.39.6.0/24) exhibits high abuse density (0.6836), indicating elevated threat activity within the neighborhood. The IP resolves to hostnames associated with ahrefs.net but presents no active services. Geographic validation anomalies detected.

---

## OWNERSHIP & NETWORK ATTRIBUTES

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 54.39.6.0/24
• Network Type: Cloud Compute / Hosting Infrastructure
• Provider: OVH (French cloud provider)
• Registration: ARIN RIR

## GEOGRAPHIC INDICATORS

• Claimed Location: Beauharnois, Quebec, Canada (CA)
• Coordinates: Latitude 45.3161, Longitude -73.8736
• Validation Status: GEOLOCATION INVALID

- RTT Violation: 31ms observed vs 112.6ms minimum for 5,629km distance

- GeoPlausible: false

- Probe Count: 5

- Minimum Possible RTT: 112.57ms

## THREAT ASSESSMENT

## SUBNET ANALYSIS (54.39.6.0/24)

• Abuse Density: 0.6836 (High)
• Classification: high_abuse
• Total Subnet Addresses: 256
• Active Addresses: 206
• Threat-Sibling IPs: 175
• Inherited Risk: 27

Risk Distribution in Subnet:

• High Risk: 0 IPs
• Medium Risk: 34 IPs
• Low Risk: 66 IPs

## NETWORK SERVICES & DNS

• DNS PTR Hostname: proxy-ca001-san115.ahrefs.net
• Forward Resolution: proxy-ca001-san115.ahrefs.net
• Open Ports: None detected
• HTTP/TLS Services: No active services (Firewalled)
• Reverse DNS: Forward-confirmed: false

## OBSERVATION HISTORY (21 Signals)

• Latest Classification: Cloud Compute Infrastructure (OVH)
• Provider Consistency: OVH (multiple observations)
• Anomalous Signals:

- RTT/Geolocation validation failures

- Cloud hosting classification inconsistencies

• Persistence: No persistent malicious behavior detected

## RELATIONSHIP MAPPING

44 relationships identified, primarily:

• Same Network: OVH-CUST-281059680 (39+ instances)
• No certificate or hostname correlation detected

## RECOMMENDED ACTIONS

Firewall Blocking Rules:

```bash

# iptables

iptables -A INPUT -s 54.39.6.115 -j DROP

# nftables

nft add rule inet filter input ip saddr 54.39.6.115 drop

# Nginx

deny 54.39.6.115;

# pfSense

54.39.6.115/32

# Cloudflare WAF

Block 54.39.6.115 — IPDebrief risk score 40

# AWS WAF

Addresses: 54.39.6.115/32

Description: IPDebrief risk 40

```

Assessment: Consider blocking due to high-abuse subnet density (0.6836). Despite individual IP showing no active services, the subnet exhibits elevated threat activity. Monitor for service activation.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.