54.39.6.91📋 Copy

IP Intelligence Briefing: 54.39.6.91/32

Date: 2026-06-09

---

**1. IP Profile**

• Risk Score: Moderate (40/100)
• Ownership:

- ISP: OVH (ASN 16276)

- Organization: Dmytro, Ahrefs Pte Ltd

- Network: OVH-CUST-281059680

• Geolocation:

- Country: Canada (QC, Beauharnois)

- Geo Plausibility: False (potential misattribution)

• Network Role:

- Cloud Compute: Hosted by OVH, no residential/mobile attributes

- Subnet: 54.39.6.0/24 (classified as "high_abuse")

• Threat Indicators:

- No direct malware, phishing, or spam associations

- DNS: Resolves to `proxy-ca001-san91.ahrefs.net` (linked to Ahrefs)

---

**2. Observation History**

• Recent Activity:

- DNS resolution for `ahrefs.net` (CAA records present)

- Geolocation data with 3km accuracy radius (plausible for Canada)

- Subnet abuse density: 52.76% (high-risk neighborhood)

• Stability:

- BGP route stable (no recent changes)

- Operator score: 0.4348 (Basic risk tier)

---

**3. Relationships**

• Network Links:

- Directly tied to OVH’s OVH-CUST-281059680 network

- Shared subnet with 254 IPs (150 active, 134 flagged as threats)

• DNS Associations:

- Linked to `proxy-ca001-san91.ahrefs.net` (Ahrefs infrastructure)

- No email authentication (SPF/DKIM/DMArc absent)

---

**4. Neighborhood Analysis**

• Subnet: 54.39.6.0/24
• Abuse Density: 52.76% (high-risk classification)
• Neighbor Risk:

- 100 IPs in subnet (40 average risk score)

- 134 IPs flagged as threats (43% of subnet)

• Inherited Risk: 21 points (likely due to high-abuse peers)

---

**5. Threat Assessment**

• No Direct Malicious Activity:

- No malware, phishing, or spam indicators

- No DNSBL listings or threat feed matches

• Indirect Risks:

- Located in a high-abuse subnet (52.76% abuse density)

- Potential misattribution in geolocation (geoPlausible: False)

- Ahrefs infrastructure may have mixed-use (legitimate + potential misuse)

---

**6. Recommendations**

• Monitoring:

- Track subnet activity for unusual traffic patterns.

- Monitor DNS queries to `ahrefs.net` for lateral movement.

• Mitigation:

- Consider rate-limiting or blocking the subnet if high-risk traffic is observed.

- Validate geolocation data for this IP.

• Investigation:

- Cross-reference with Ahrefs’ infrastructure to confirm legitimate use.

Note: This IP is part of a high-risk subnet but lacks direct malicious signals. Further investigation into its network behavior and Ahrefs’ infrastructure is advised.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.