54.39.89.109📋 Copy

IP Intelligence Briefing: 54.39.89.109

Date: June 9, 2026

---

**1. Profile Summary**

• Risk Score: 50 (Moderate Risk)
• Ownership:

- ASN: 16276 (OVH)

- Organization: Dmytro, Ahrefs Pte Ltd

- Network: OVH-CUST-281059691

• Geolocation:

- Country: Canada (QC, Beauharnois)

- Geo Validation: Invalid (RTT of 27ms inconsistent with 5,629km distance; plausible spoofing).

• Threat Indicators:

- No malicious indicators, blacklists, or campaigns linked.

- Cloud Compute: Hosted by OVH (cloud infrastructure).

---

**2. Observation History**

• Recent Activity (Last 30 Days):

- Network Classification: Consistently identified as CloudCompute.

- DNS: Resolves to `proxy-ca012-san109.ahrefs.net` (Ahrefs subdomain).

- Traceroute Anomalies: Persistent RTT discrepancies (27ms vs. expected 112.6ms for distance).

- Subnet Abuse Density: 0.43 (mixed risk; 105 threat siblings in /24 subnet).

---

**3. Relationships**

• Network Associations:

- Linked to OVH-CUST-281059691 (same subnet).

- DNS: Directly tied to `proxy-ca012-san109.ahrefs.net` (Ahrefs).

• Subnet Context:

- Total Siblings: 243 IPs in 54.39.89.0/24.

- Threat Siblings: 105 IPs flagged as risky.

---

**4. Neighborhood Analysis**

• Subnet Risk: Mixed (abuse density 0.43).
• Neighbor Risk Distribution:

- Low Risk: 38 IPs (risk score ≤ 40).

- Medium Risk: 62 IPs (risk score 41–60).

- High Risk: 0 IPs.

---

**5. Key Findings & Recommendations**

• Geolocation Discrepancy: The IP's reported location in Canada conflicts with its RTT profile, suggesting potential spoofing or misconfigured geolocation data. Monitor for anomalies in network traffic patterns.
• Cloud Infrastructure: Likely a legitimate Ahrefs server, but verify against internal whitelists.
• Subnet Risk: While the IP itself is low-risk, the subnet contains 105 risky neighbors. Consider monitoring or segmenting traffic to mitigate potential lateral movement.
• DNS Association: The `proxy-ca012-san109.ahrefs.net` hostname is linked to Ahrefs. Confirm if this is a known service or a potential attack vector.

Action Items:

• Validate geolocation accuracy using alternative sources.
• Monitor the 54.39.89.0/24 subnet for unusual activity.
• Cross-check with internal threat intelligence feeds to confirm Ahrefs' legitimacy.

---

End of Briefing

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.