54.39.89.173📋 Copy

# IP Intelligence Briefing: 54.39.89.173/32

## Executive Summary

IP address 54.39.89.173 is a moderate-risk (40/100) hosting infrastructure endpoint operated by OVH (ASN 16276) under the organization "Dmytro, Ahrefs Pte Ltd." The subnet demonstrates elevated abuse density (0.7578) with 194 of 256 total siblings classified as threat sources. No active threat indicators were detected, though geolocation validation anomalies and DNSBL listings warrant monitoring.

## Infrastructure Profile

• Owner/Operator: OVH (ASN 16276), Customer ID: OVH-CUST-281059691
• Organization: Dmytro, Ahrefs Pte Ltd
• Geolocation: Beauharnois, QC, CA (3000km accuracy radius)
• Network Classification: Hosting provider, firewalled/no services detected
• DNS Resolution: proxy-ca012-san173.ahrefs.net (forward resolution unconfirmed)
• Email Authentication: SPF/DMARC not configured

## Risk Assessment

## Neighborhood Analysis

The 54.39.89.0/24 subnet exhibits high-abuse classification with the following distribution:

• Abuse Density: 0.7578 (high)
• Threat Siblings: 194 of 256 total IPs
• Active Siblings: 167 of 256
• Neighbor Risk Profile: Uniform risk score of 40 across sampled neighbors

## Threat Indicators

• Known Attacker: No
• Tor Exit Node: No
• Proxy/VPN: No
• Spam Source: No
• Active Campaigns: None detected
• Threat Feeds: Empty

## Geolocation Validation

Anomaly Detected: RTT measurement (28.0ms) is inconsistent with reported geolocation distance (5629km). Minimum possible RTT for this distance should be 112.6ms. This discrepancy suggests either inaccurate geolocation data or routing anomalies.

## Historical Observations

21 observations recorded as of 2026-06-20. Recent signals indicate:

• Consistent Canada (CA) country code attribution
• Stable abuse density metrics (0.7578)
• Minimal operator classification
• No ownership changes detected

## Related Entities

52 relationships identified, primarily network-level associations (OVH-CUST-281059691). No certificate, hostname, or organization-level correlations beyond network classification.

## Recommended Actions

• Monitor: Track for escalation in risk score or new threat indicators
• Block: No immediate blocking recommended; risk score below typical threshold
• Investigate: Geolocation validation anomaly warrants further review if this IP appears in suspicious traffic patterns
• Whitelist Consideration: Legitimate hosting infrastructure with no active threat indicators

## Intelligence Summary

This IP represents OVH hosting infrastructure with moderate risk characteristics driven primarily by subnet-level abuse density rather than individual IP threat activity. The high-abuse subnet classification suggests this endpoint may be shared infrastructure commonly used for legitimate hosting alongside potentially compromised neighbors. No direct threat intelligence indicators detected; monitoring recommended for contextually relevant traffic patterns.

*Report generated: 2026-06-20*

*Data sources: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.