54.39.89.238📋 Copy

## IP Intelligence Briefing: 54.39.89.238/32

Classification: MODERATE RISK

Reporting Date: Current Analysis Cycle

Executive Summary

IP address 54.39.89.238 is a cloud compute resource associated with OVH hosting infrastructure located in Beauharnois, Quebec, Canada. The IP exhibits moderate risk (score: 40) with no active threat indicators but operates within a high-abuse-density subnet. No open services detected; traffic appears to be firewalled.

Ownership and Registration

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 54.39.89.0/24
• Registration Authority: ARIN
• Infrastructure Type: CloudCompute (OVH provider)

Geolocation

• Country: Canada (CA)
• Region/Province: Quebec (QC)
• City: Beauharnois
• Accuracy Radius: 3000km
• Geo Validation: Consensus enabled, geo-plausibility flag not set

Network Classification

• Hosting: Enabled
• CDN/Proxy/VPN: None detected
• Tor Exit Node: No
• Mobile/Residential: No
• Bogon: No
• Anycast: No

DNS and Hostnames

• PTR Record: proxy-ca012-san238.ahrefs.net
• Hosted Domain: ahrefs.net
• Forward Resolution: Confirmed (1 hostname)
• DNSSEC: Valid
• CAA Records: Present

Threat Indicators

• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Active Threat Campaigns: None detected
• Control Plane Operator Score: 0.2174 (Minimal)

Neighborhood Analysis (54.39.89.0/24)

• Total Subnet Siblings: 256
• Active Siblings: 132
• Threat Siblings: 192
• Abuse Density: 0.75 (High)
• Inherited Risk: 30
• Classification: High Abuse

Historical Observations

• Total Signal Observations: 23
• Risk Persistence Days: 0
• Ownership Changes: 0
• Latest Operator Score: 0.2174 (Minimal)
• Observation Trend: Consistent minimal operator score across recent signals

Services and Ports

• Open Ports: None detected
• HTTP Title: Not available
• TLS Certificate: None
• Service Banner: None
• Service Purpose: Firewalled / No Services

Recommended Security Actions

Firewall Rules (Block Recommended)

*iptables:*

```

iptables -A INPUT -s 54.39.89.238 -j DROP

```

*nftables:*

```

nft add rule inet filter input ip saddr 54.39.89.238 drop

```

*nginx:*

```

deny 54.39.89.238;

```

*pfSense:*

```

54.39.89.238/32

```

*Cloudflare WAF:*

```json

{

"description": "Block 54.39.89.238 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 54.39.89.238"

}

}

```

*AWS WAF:*

```json

{

"Addresses": ["54.39.89.238/32"],

"Description": "IPDebrief risk 40"

}

```

Intelligence Assessment

The IP is associated with Ahrefs infrastructure but operates within a high-abuse-density OVH subnet with 192 threat-identified siblings. Despite no direct threat indicators on this specific address, the subnet-level risk suggests defensive blocking is warranted. The IP shows no active services, consistent with firewalled cloud infrastructure. Monitor for any service activation or behavioral changes.

Action Priority: MODERATE — Block with monitoring capability

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.