54.39.6.200📋 Copy

# INTELLIGENCE BRIEFING: IP 54.39.6.200/32

## EXECUTIVE SUMMARY

IP address 54.39.6.200/32 is a moderate-risk infrastructure host operated by OVH in Canada. The IP belongs to a high-abuse density subnet with significant neighborhood risk, though the target IP itself shows no direct threat indicators. Current classification indicates cloud compute infrastructure with no active services.

## PROFILE OVERVIEW

Risk Assessment: Moderate Risk (Score: 40/100)

Provider: OVH (ASN 16276)

Organization: Dmytro, Ahrefs Pte Ltd

Network Block: 54.39.6.0/24

Geolocation: Beaucharnois, Quebec, Canada

Infrastructure Type: Cloud Compute / Hosting

## THREAT INTELLIGENCE

Direct Threat Indicators: None detected

• Not classified as Tor exit node, known attacker, or spam source
• Blacklist count: 0
• DNSBL listings: 1 of 8 total lists
• No known threat campaigns correlated

Network Role: Cloud infrastructure with firewalled configuration (no services detected on open ports)

Control Plane Data:

• BGP Prefix: 54.39.0.0/16
• Route stability: Flagged as unstable
• DNSSEC: Valid
• Operator score: 0.2174 (Minimal operator concern)

## NEIGHBORHOOD ANALYSIS

Subnet Risk Profile: HIGH ABUSE

• Abuse density: 0.6602
• Subnet classification: High abuse
• Total sibling IPs: 256
• Active sibling IPs: 182
• Threat sibling IPs: 169 (67% of active siblings)
• Inherited risk score: 26

Risk Distribution in /24:

• High risk: 0
• Medium risk: 100
• Low risk: 0

The /24 subnet demonstrates elevated abuse activity with the majority of active neighbors scoring in the medium risk range. This contextualizes the IP within a broader infrastructure pattern of hosting-related abuse.

## OBSERVATION HISTORY

Total Observations: 21

Timeline: June 2019 through June 2026

Key Trends:

• Consistent "high_abuse" classification for subnet across observation periods
• Subnet abuse density maintained at 0.6602
• Operator scores fluctuated between 0.087 and 0.2174
• No ownership changes recorded
• Threat persistence: 0 days (not persistently malicious)

Most Recent Signals (June 25, 2026):

• Operator score: 0.1 (Minimal concern)
• Overall profile confidence: Low (0.1956)
• Signal coverage: All 6 dimensions covered

## RELATIONSHIP GRAPH

Total Relationships: 62

Primary Association: OVH-CUST-281059680 network

• Multiple relationships confirm infrastructure ownership
• Consistent network attribution across all relationship types
• No relationships to known malicious organizations or campaigns

## DNS & SERVICES

PTR Record: proxy-ca001-san200.ahrefs.net

Domain: ahrefs.net

Forward Resolution: Confirmed (1 hostname)

Services: No open ports detected

TLS Certificate: Not available

HTTP Title: Not available

## RECOMMENDED ACTIONS

No specific firewall rules or blocking recommendations generated based on current risk profile. The IP demonstrates moderate risk primarily due to neighborhood context rather than direct threat indicators.

Recommended Monitoring Strategy:

• Monitor for changes in service exposure (currently firewalled)
• Track neighborhood activity in 54.39.6.0/24 subnet
• Watch for DNSBL listing changes (currently 1 of 8 lists)
• No immediate blocking advised; maintain passive monitoring

---

Analyst Notes: This IP represents legitimate cloud infrastructure hosting services (Ahrefs.net) within a high-abuse neighborhood. The moderate risk score (40) reflects neighborhood context rather than IP-specific malicious activity. SOC teams should focus on behavioral monitoring rather than static blocking.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.