54.39.89.131📋 Copy

IP Intelligence Briefing: 54.39.89.131

*Generated via IPDebrief Analysis*

---

**Core Profile**

• Risk Score: 40 (Moderate Risk)
• Ownership: Owned by OVH (AS16276) under Dmytro, Ahrefs Pte Ltd.
• Geolocation: Canada (QC, Beauharnois), but geolocation validation failed due to anomalous RTT (26ms vs. expected 112.6ms for 5,629km).
• Network Role: Hosting provider (firewalled, no services detected).

---

**Threat Indicators**

• No direct threats: No malware indicators, spam, or known attacker associations.
• Geo Validation Alert: RTT discrepancy suggests potential spoofing or misconfigured routing.
• Subnet Abuse: Subnet 54.39.89.0/24 has high abuse density (51.41%), with 128 risky sibling IPs.

---

**Network Relationships**

• Linked to: OVH network OVH-CUST-281059691 (ASN16276).
• DNS: Resolves to proxy-ca012-san131.ahrefs.net (no email auth records).
• BGP: Route stability confirmed; AS path: 34549 → 16276.

---

**Neighbor Analysis**

• Subnet: 54.39.89.0/24 (249 total IPs).
• Risk Distribution:

- 88 IPs with medium risk (score 40–50).

- 12 IPs with low risk.

• Notable: 100% of neighbors in the subnet have abuse density > 50%, indicating potential coordinated activity.

---

**Actionable Insights**

1. Monitor Subnet: The high abuse density in 54.39.89.0/24 suggests a potential compromised network.

2. Investigate Geo Anomalies: The RTT discrepancy may indicate spoofing or routing issues.

3. Check Hosting Context: Since the IP is a hosting provider, validate if it’s used for legitimate services or malicious campaigns.

4. Track Neighbors: Prioritize monitoring IPs with medium risk scores in the subnet for lateral movement.

---

*End of Briefing*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.