54.39.89.83📋 Copy

# IP Intelligence Briefing: 54.39.89.83/32

## Executive Summary

IP address 54.39.89.83 resolves to OVH cloud infrastructure in Canada with a moderate risk score (50/100). The IP is associated with the ahrefs.net domain and operates as cloud hosting infrastructure. While no direct attack indicators were observed, the IP exhibits geolocation anomalies and resides within a high-abuse-density subnet.

## Profile Analysis

Ownership & Network:

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 54.39.89.0/24
• Classification: CloudCompute/Hosting infrastructure

Geolocation:

• Reported Location: Beauharnois, Quebec, Canada
• Status: GEOLOCATION INVALIDATED
• Violation: Claimed RTT of 27ms contradicts minimum possible RTT of 112.6ms for reported 5,629km distance
• GeoPlausible flag: FALSE

DNS Resolution:

• PTR Hostname: proxy-ca012-san83.ahrefs.net
• Forward Resolution: proxy-ca012-san83.ahrefs.net (1 hostname)
• Domain: ahrefs.net
• Email Authentication: SPF/DMARC not configured

Network State:

• Open Ports: None detected
• Service Status: Firewalled/No Services
• TLS Certificate: Not observed

## Threat Assessment

Direct Indicators:

• No active threat indicators in profile
• Not listed as Tor exit, known attacker, or spam source
• Blacklist count: 0 (profile) / 2 (control plane DNSBL)

Control Plane Anomalies:

• DNSBL Listed Count: 2 out of 8 total lists
• RPKI State: Not verified
• Route Stability: False (not route-stable)
• Operator Score: 0.2174 (Minimal)

## Neighborhood Intelligence

Subnet: 54.39.89.0/24

• Abuse Density: 0.7578 (HIGH)
• Classification: high_abuse
• Active Siblings: 167 out of 256 total IPs
• Threat Siblings: 194
• Inherited Risk Score: 30/100
• Neighboring IP Risk Scores: Consistent medium risk (40/100)

## Observation History (24 observations)

Recent activity shows:

• 2026-06-28: Cloud infrastructure signals (is_cloud: true, is_hosting: true)
• 2026-06-28: DNSBL listings observed (8 total lists, 1 max severity: high)
• 2026-06-28: DNS CAA records present
• 2026-06-20: Geolocation anomalies detected with RTT violations
• No persistent malicious behavior observed over observation period

## Relationships

54 relationships detected, all classified as "Same Network" relationships pointing to OVH-CUST-281059691. No external hostname, organization, or certificate relationships beyond the network classification.

## Recommended Actions

Immediate Mitigation:

• iptables: `iptables -A INPUT -s 54.39.89.83 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 54.39.89.83 drop`
• nginx: `deny 54.39.89.83;`
• pfSense: Block 54.39.89.83/32
• Cloudflare WAF: Block 54.39.89.83 (risk score 50)
• AWS WAF: Add 54.39.89.83/32 to IP set for blocking

Analysis Notes:

The geolocation discrepancy (claimed Canadian location with Asian RTT characteristics) suggests potential IP spoofing or misattribution. The high-abuse-density subnet warrants monitoring of additional 54.39.89.0/24 addresses. No evidence of active malicious activity, but the IP's association with a high-risk neighborhood and geolocation anomalies warrant conservative blocking posture.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.