54.39.89.193📋 Copy

# INTELLIGENCE BRIEFING: IP 54.39.89.193/32

Classification: MODERATE RISK

Risk Score: 40/100

Report Generated: 2026-06-21

## EXECUTIVE SUMMARY

IP address 54.39.89.193 is a cloud-hosted infrastructure endpoint associated with OVH (ASN 16276). The IP resolves to ahostname affiliated with ahrefs.net but operates within a subnet exhibiting high abuse density (77.34%). No active services or open ports detected. Recommended action: Block at perimeter firewall.

---

## OWNERSHIP & GEOLOCATION

• Organization: Dmytro, Ahrefs Pte Ltd
• Netname: OVH-CUST-281059691
• ASN: 16276 (OVH)
• Location: Beauharnois, Quebec, Canada (CA)
• CIDR Block: 54.39.89.0/24
• Infrastructure Type: Cloud Compute / Hosting

---

## NETWORK CLASSIFICATION

---

## DNS ANALYSIS

• PTR Hostname: proxy-ca012-san193.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Not confirmed
• Email Authentication:

- SPF: Not configured

- DMARC: Not configured

- TXT Records: 0

---

## THREAT INDICATORS

• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Matches: 0
• DNSBL Listings: 1 of 8 total lists

---

## NEIGHBORHOOD ANALYSIS (54.39.89.0/24)

The subnet demonstrates elevated abuse activity with 77.34% abuse density. 198 of 256 sibling IPs are classified as threat sources.

---

## OBSERVATION HISTORY

Recent signal observations indicate:

• Consistent DNS resolution to ahrefs.net domain
• Subnet abuse density classified as "high_abuse"
• Operator score: 0.2174 (Minimal)
• Route stability: False
• No persistent malicious behavior observed

---

## SECURITY RECOMMENDATIONS

Based on risk score (40) and neighborhood context, the following firewall rules are recommended:

iptables

```bash

iptables -A INPUT -s 54.39.89.193 -j DROP

```

nftables

```bash

nft add rule inet filter input ip saddr 54.39.89.193 drop

```

Cloudflare WAF

```json

{

"description": "Block 54.39.89.193 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 54.39.89.193"

}

}

```

AWS WAF

```json

{

"Addresses": ["54.39.89.193/32"],

"Description": "IPDebrief risk 40"

}

```

---

## ASSESSMENT

This IP represents moderate-risk cloud hosting infrastructure within a high-abuse subnet. While the IP itself shows no active threat indicators, the neighborhood context (77% abuse density, 198 threat siblings) suggests elevated risk. The hostname association with ahrefs.net appears legitimate, but DNS forward resolution is unconfirmed and email authentication records are missing. Recommend blocking at network perimeter and monitoring for any behavioral changes.

Status: BLOCK RECOMMENDED

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.