54.39.89.160📋 Copy

## INTELLIGENCE BRIEFING: 54.39.89.160/32

CLASSIFICATION: Moderate Risk | TIMESTAMP: 2026-06-23

EXECUTIVE SUMMARY

IP address 54.39.89.160 is assigned to OVH cloud infrastructure (ASN 16276, organization: Dmytro/Ahrefs Pte Ltd) and maintains a moderate risk profile with a risk score of 40/100. The address operates within a high-abuse density subnet (54.39.89.0/24) showing elevated neighborhood threat indicators.

OWNERSHIP & INFRASTRUCTURE

• Network: 54.39.89.0/24 (OVH-CUST-281059691)
• ASN: 16276
• Organization: Dmytro, Ahrefs Pte Ltd
• Infrastructure Type: CloudCompute (Hosting enabled)
• Geolocation: Canada, Quebec, Beauharnois (3000km accuracy radius)
• Registration: ARIN

NETWORK ROLE & CLASSIFICATION

• Primary Classification: Cloud hosting infrastructure
• Provider: OVH
• Connection Type: Firewalled/No Services detected
• Anycast: No
• Proxies/VPN/Tor: Not identified

DNS & HOSTING ANALYSIS

• PTR Hostnames: proxy-ca012-san160.ahrefs.net
• Forward Resolution: Forward confirmed to ahrefs.net (1 hostname)
• Email Authentication: SPF and DMARC not configured
• Service Status: No open ports detected; infrastructure appears firewalled

THREAT INDICATORS

• Abuse Confidence: Not scored
• Known Campaigns: None identified
• Blacklist Count: 0 (profile) / 1 DNSBL listing (control plane)
• Tor Exit: No
• Known Attacker: No
• Spam Source: No

NETWORK THREAT LANDSCAPE

• Subnet Abuse Density: 0.75 (high_abuse classification)
• Total Siblings: 256 in /24 block
• Active Siblings: 132
• Threat Siblings: 192
• Inherited Risk Score: 30/100
• Neighborhood Risk Distribution: 100 medium-risk neighbors, 0 high-risk, 0 low-risk

OBSERVATION HISTORY (24 TOTAL OBSERVATIONS)

• Latest Observation: 2026-06-23T18:36:10
• Signal Consistency: Mixed signals with minimal operator scores (0.087-0.30)
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0 recorded

GEOVALIDATION ANOMALIES

• RTT Violation Detected: 27.0ms measured vs. 112.6ms minimum possible for 5629km distance
• Geo Plausible: No
• Minimum RTT: 27ms
• Average RTT: 31.2ms
• Probe Count: 5

RECOMMENDED ACTIONS

• Monitor: Track subnet-level threat indicators; 192 threat siblings in same /24 block
• Block Consideration: Evaluate blocking if traffic patterns indicate malicious activity; neighborhood shows elevated abuse density
• Email Security: Verify email authentication headers (SPF/DMARC not configured)
• Traffic Analysis: No services detected; monitor for service emergence

ENDNOTES

This IP belongs to OVH cloud hosting infrastructure and is associated with the ahrefs.net domain. While the IP itself shows no direct threat indicators, the subnet demonstrates high abuse density. Monitor for anomalous traffic patterns or service emergence that could indicate compromised infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.