54.39.89.144📋 Copy

# IP Intelligence Briefing: 54.39.89.144/32

Classification: Moderate Risk (Score: 50)

Analysis Date: Current

Data Sources: IPDebrief Intelligence Platform

---

## Executive Summary

IP address 54.39.89.144 is associated with OVH cloud infrastructure in the Ahrefs hosting network. While the IP itself shows no active threat indicators, it resides within a high-abuse-density subnet (0.7578) with significant correlated malicious activity. The infrastructure is cloud-hosted and appears to be a proxy endpoint without open services.

---

## Technical Profile

Ownership & Infrastructure:

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 54.39.89.0/24
• Provider: OVH Cloud Compute
• Infrastructure Type: Cloud hosting environment

Network Role:

• Cloud infrastructure with hosting services enabled
• No open ports detected (firewalled/no services)
• Connection type: Not classified as CDN, VPN, proxy, or Tor

Geolocation:

• Reported Location: Beauharnois, QC, Canada (CA)
• Geolocation Confidence: Low (5 sources, consensus true but plausible validation failed)
• Validation Issue: RTT measurement indicates geoimpossible condition — measured 29ms RTT against 5629km distance (minimum expected RTT: 112.6ms)

---

## Threat Indicators

Current Threat Status: None

• Blacklist Count: 0
• Known Campaigns: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

DNS Reputation:

• DNSBL Listings: 2 lists flagged (of 8 total)
• PTR Hostname: proxy-ca012-san144.ahrefs.net
• Domain: ahrefs.net
• Email Auth: SPF and DMARC not configured

Control Plane Data:

• BGP Prefix: 54.39.0.0/16
• Route Stability: Stable (no route changes in 30 days)
• RPKI State: Valid
• DNSSEC: Validated

---

## Neighborhood Analysis

Subnet Risk Profile (54.39.89.0/24):

• Abuse Density: 0.7578 (High)
• Total Siblings: 256
• Active Siblings: 176
• Threat Siblings: 194
• Inherited Risk Score: 30

Neighbor Risk Distribution:

• Medium Risk: 100 neighbors
• High Risk: 0 neighbors
• Low Risk: 0 neighbors

---

## Observation History

Signal Count: 24 observations

Threat Persistence: 1 observation

Malicious Behavior: Not persistently malicious

Recent Signals (2026-06-20):

• Subnet abuse density: 0.7578 (high_abuse classification)
• No banner matches or campaign correlations detected
• No certificate matches
• Service scan: No open ports, ports scanned but services not responding

---

## Risk Assessment

Key Risk Factors:

1. High-abuse-density subnet (0.7578) with 194 threat-sibling IPs

2. DNSBL listings on 2 of 8 available lists

3. Geolocation validation failure (RTT discrepancy)

4. Proxy hostname association (proxy-ca012-san144.ahrefs.net)

Mitigating Factors:

1. No current threat indicators or active malicious campaigns

2. No known attacker or spam source classification

3. Cloud infrastructure with firewalled/no-services status

4. Stable BGP routing and valid DNSSEC

---

## Recommended Actions

Firewall Rules:

• Monitor traffic to/from this IP for unusual patterns
• Consider blocking if destination is internal network
• Log all connections for forensic analysis

Monitoring:

• Track subnet-wide abuse trends (54.39.89.0/24)
• Monitor DNSBL listing changes
• Watch for service port openings

Threat Hunting:

• Investigate the 194 threat-sibling IPs in the subnet
• Review historical correlations with ahrefs.net domain activity
• Monitor for certificate issuance in the network

---

Intelligence Confidence: Medium

Last Updated: Current analysis cycle

Data Freshness: Recent observations available

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.