54.39.89.196
IP Intelligence Briefing: 54.39.89.196
Date: 2026-06-05
---
**Risk Profile**
- Risk Score: 40 (Moderate Risk)
- Provider: OVH (ASN 16276)
- Organization: Ahrefs Pte Ltd (OVH-CUST-281059691)
- Geolocation: Canada (QC, Beauharnois)
---
**Threat Indicators**
- No direct malicious indicators (no malware, phishing, or spam sources).
- Subnet Abuse Density: 52.21% (High Abuse, inherited risk: 20).
- Neighboring IPs: 100 total IPs in 54.39.89.0/24; 88 medium-risk, 12 low-risk.
---
**Network & Hosting**
- Cloud Compute: Hosted by OVH, likely a virtual server.
- DNS Associations: Linked to `proxy-ca012-san196.ahrefs.net` (Ahrefs infrastructure).
- Services: No open ports or TLS certificates detected.
---
**Observation History**
- First Seen: 2026-06-05 (1 observation).
- Stability: Subnet routes unstable (route changes in 30 days: 0).
- Ownership: Stable (no recent ownership changes).
---
**Actionable Recommendations**
1. Monitor Subnet: High abuse density in 54.39.89.0/24 suggests potential for lateral movement or compromised hosts.
2. Block IP: Implement firewall rules to block traffic from 54.39.89.196 if not required.
- Example:
```bash
iptables -A INPUT -s 54.39.89.196 -j DROP
nft add rule inet filter input ip saddr 54.39.89.196 drop
```
3. Verify DNS: Investigate `proxy-ca012-san196.ahrefs.net` for potential misconfigurations or abuse.
4. Check Hosting Provider: Confirm Ahrefs’ security practices for cloud instances.
---
Conclusion: While the IP itself shows no direct threats, its location in a high-abuse subnet warrants closer scrutiny. Monitor for unusual activity and validate the necessity of connectivity to this IP.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Dmytro, Ahrefs Pte Ltd |
| ASN | AS16276 |
| Network Name | OVH-CUST-281059691 |
| CIDR Block | 54.39.89.0/24 |
| RIR | ARIN |
| Country | Singapore |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | proxy-ca012-san196.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-ca012-san196.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 28% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 8% | 1 | 1 |
| ownership | 19% | 2 | 2 |
| reputation | 30% | 1 | 3 |
| geolocation | 23% | 2 | 2 |
| Overall | 20% | 9 | 12 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-09 22:11:23 UTC |
| Last Seen | 2026-06-27 16:46:16 UTC |
| Profile Built | 2026-06-28 10:51:08 UTC |
| Data Freshness | Live |
| Signal Types | 18 |
| Total Observations | 23 |
Full dossier details are available via our API.