54.39.89.140📋 Copy

# IP Intelligence Briefing: 54.39.89.140/32

## Executive Summary

IP address 54.39.89.140 operates within OVH cloud infrastructure (AS16276) under the organization Dmytro, Ahrefs Pte Ltd. The IP carries a moderate risk score (40/100) with no direct threat indicators. However, the associated /24 subnet exhibits elevated abuse density (0.75), warranting neighborhood-level monitoring.

## Technical Profile

Ownership & Infrastructure:

• ASN: 16276 (OVH SAS)
• CIDR Block: 54.39.89.0/24
• Network Classification: CloudCompute / Hosting Infrastructure
• PTR Record: proxy-ca012-san140.ahrefs.net
• Forward Resolution: proxy-ca012-san140.ahrefs.net (1 hostname)
• Domain Association: ahrefs.net

Geolocation Analysis:

• Reported Location: Beauharnois, QC, Canada
• Status: INVALID — RTT measurement (26ms) is below minimum possible latency (112.6ms) for 5,629km distance, indicating geolocation data is not trustworthy.

Network Services:

• Open Ports: None detected
• Connection State: Firewalled / No Services
• DNSSEC Valid: Yes
• CAA Records: Present

## Threat Intelligence

Direct Threat Indicators:

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Listed: 1 of 8 total lists
• Known Campaigns: None detected

Neighborhood Analysis (54.39.89.0/24):

• Abuse Density: 0.75 (High)
• Subnet Classification: high_abuse
• Total Siblings: 256
• Active Siblings: 132
• Threat Siblings: 192
• Inherited Risk: 30/100

## Temporal Observations

• Ownership Changes: 0
• Threat Persistence: 0 days
• Persistently Malicious: No
• Observation History: 20 signals recorded on 2026-06-18

## Recommended Actions

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 54.39.89.140 -j DROP

# nftables

nft add rule inet filter input ip saddr 54.39.89.140 drop

# nginx

deny 54.39.89.140;

# pfSense

54.39.89.140/32

# Cloudflare WAF

ip.src eq 54.39.89.140

# AWS WAF

Addresses: 54.39.89.140/32

```

Monitoring Recommendations:

• Monitor the 54.39.89.0/24 subnet for additional suspicious activity (192 threat siblings detected)
• Validate geographic claims against actual network latency data
• Track DNS activity for the ahrefs.net domain associated with this IP
• Review firewall rules for the full /24 subnet given the high abuse density (0.75)

Classification: Moderate Risk — Cloud Infrastructure with Neighborhood Abuse Concerns

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.