54.39.89.174📋 Copy

IP Intelligence Briefing: 54.39.89.174

Date: June 18, 2026

---

**1. Risk Profile**

• Overall Risk: Moderate (Risk Score: 40)
• Provider: OVH (ASN: 16276)
• Ownership: Registered to *Dmytro, Ahrefs Pte Ltd* (OVH-CUST-281059691)
• Geolocation: Canada (QC, Beauharnois) | Geo Validation: High RTT (27ms) vs. 5,629km distance (expected min 112ms) – potential misconfiguration or proxy.
• Network Role: Cloud Compute (OVH) | Hosting | No open services detected.

---

**2. Threat Indicators**

• No direct malicious activity: No abuse confidence scores, blacklists, or known campaigns.
• Subnet Abuse:

- 54.39.89.0/24 has 61% abuse density (157/256 IPs flagged).

- 105 active IPs in subnet, with 24 inherited risk points.

• DNS:

- PTR hostname: `proxy-ca012-san174.ahrefs.net` (linked to Ahrefs, a legitimate SEO tool company).

- No email auth (SPF/DKIM) detected.

---

**3. Historical Observations**

• Single observation (June 18, 2026):

- Minimal risk score (0.2174) | High abuse classification (subnet).

- DNSSEC/CAA validated but DNSBL listed (1/8 lists).

---

**4. Network Relationships**

• Linked to OVH network (OVH-CUST-281059691) | 256 IPs in subnet.
• No direct relationships to known malicious entities or campaigns.

---

**5. Recommendations**

• Monitor subnet activity: High abuse density in 54.39.89.0/24 suggests potential lateral movement or shared infrastructure risks.
• Verify geolocation anomalies: Investigate the low RTT vs. distance discrepancy (could indicate spoofing or proxy use).
• Check Ahrefs’ infrastructure: Confirm if this IP is part of legitimate cloud hosting or unusual activity.
• Block suspicious siblings: Consider firewall rules for high-risk IPs in the subnet (e.g., via iptables/nftables).

Conclusion: While the IP itself shows no direct malicious signals, its association with a high-abuse subnet and geo validation anomalies warrants further investigation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.