54.39.89.184📋 Copy

IP Intelligence Briefing: 54.39.89.184

*Generated via IPDebrief tools for SOC analysis*

---

**1. Core Profile**

• Risk Score: 25 (Low Risk)
• Ownership: Registered to Ahrefs Pte Ltd (OVH, ASN 16276)
• Geolocation:

- Country: US (New York)

- Subnet: 54.39.89.0/24

- Confirmed as cloud-hosted infrastructure (OVH CloudCompute)

• Threat Indicators: No malicious activity detected. No known attacker, spam, or Tor associations.
• Network Role:

- Cloud-based server (OVH)

- No public services (open ports, TLS certs, or HTTP banners)

---

**2. Observation History**

• Latest Risk Signal (June 12, 2026):

- Risk Score: 66 (Proxy/VPN association)

- Source: ProxyCheck.io (Canada, Quebec)

- Classification: "Minimal" risk with mixed geolocation anomalies.

• Trend: Stable over 30 days; no persistent malicious activity.

---

**3. Relationships**

• DNS Associations:

- Linked to proxy-ca012-san184.ahrefs.net (Ahrefs infrastructure).

• Network:

- Subnet 54.39.89.0/24 (OVH-CUST-281059691)

- Shared ownership with 246 IPs in the subnet.

---

**4. Neighborhood Analysis**

• Subnet Abuse Density:

- 86/100 IPs classified as medium-risk (likely cloud/VPN infrastructure).

- 14/100 IPs low-risk (legitimate services).

• Neighboring IPs:

- 114 IPs flagged as potential threats (e.g., proxies, misconfigured hosts).

- 83 active IPs in the subnet.

---

**5. Key Findings & Recommendations**

• Low Risk but Contextual Concerns:

- The IP is part of Ahrefs' infrastructure, but its association with a proxy service (via DNS) raises questions about potential misuse.

- Subnet has moderate abuse density, suggesting monitoring for lateral movement or compromised hosts.

• Actionable Steps:

1. Monitor subnet traffic for anomalies (e.g., unexpected DNS queries, TLS handshake failures).

2. Verify proxy service legitimacy (Ahrefs is a legitimate company, but ensure no unauthorized use).

3. Check for DNS misconfigurations in the 54.39.89.0/24 subnet.

---

Conclusion: 54.39.89.184 is a low-risk cloud server with no direct malicious indicators. However, its subnet contains a mix of legitimate and potentially risky hosts, requiring ongoing monitoring. No immediate mitigation actions are required unless proxy activity escalates.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.