79.137.89.206📋 Copy

# IP Intelligence Briefing: 79.137.89.206/32

## Executive Summary

IP 79.137.89.206 is classified as a Moderate Risk infrastructure address hosted by OVH SAS. The IP shows no active threat indicators but is listed on 2 of 8 DNSBLs, suggesting potential reputation issues. No immediate malicious activity was observed.

## Infrastructure Profile

Ownership & Network:

• Organization: OVH SAS (ASN: 16276)
• Network Name: SD-onenetwork
• CIDR Block: 79.137.89.0/24
• Registry: RIPE NCC
• Infrastructure Type: Cloud Computing / Hosting Provider
• Geolocation: France (FR)

DNS Resolution:

• PTR Hostname: ns3239205.ip-79-137-89.eu
• Forward Resolution: Confirmed
• Hosted Domains: 0 (DNS-only address)

Network Classification:

• Status: Cloud infrastructure with firewall protection
• Open Ports: None detected
• Services: Firewalled / No Services exposed
• DNSSEC Valid: Yes

## Risk Assessment

Current Risk Score: 50/100 (Moderate)

Threat Indicators:

• Abuse Confidence Score: Not reported
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0 (current blacklist count)
• DNSBL Listed: 2 of 8 total lists

Control Plane Anomalies:

• Route Stability: Unstable
• RPKI State: Not evaluated
• Route Changes (30d): 0
• Operator Score: 0.2609 (Basic)

## Observation History

Signal Count: 16 historical observations

Key Timeline Events:

• 2026-08-13 15:45:15 — Ownership confirmed: OVH SAS, RIR RIPE, CIDR 79.137.89.0/24
• 2026-08-13 15:46:48 — Traceroute observed 30 hops (17 timed out), geolocation inferred US (likely false positive)
• 2026-08-13 15:47:51 — Ownership stability confirmed (0 changes)

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: No

## Relationship Mapping

Connected Entities:

• DNS Associations: ns3239205.ip-79-137-89.eu (multiple entries)
• Network Associations: SD-onenetwork (OVH)
• Total Relationships: 8

No external organizational links or certificate associations detected.

## Neighborhood Analysis

/24 Subnet: 79.137.89.0/24

• Neighbor Count: 0 (no active sibling IPs detected)
• Abuse Density: 0
• Threat Siblings: 0
• Classification: Low risk subnet profile

## Recommended Security Actions

Blocking Rules Available:

• iptables: `iptables -A INPUT -s 79.137.89.206 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 79.137.89.206 drop`
• nginx: `deny 79.137.89.206;`
• pfSense: Block rule for 79.137.89.206/32
• Cloudflare WAF: Block rule with description "IPDebrief risk score 50"
• AWS WAF: Block IP 79.137.89.206/32

Analysis Note: Actions are probabilistic and should be combined with other threat signals before implementation.

## Intelligence Assessment

This IP represents standard OVH cloud infrastructure with no active malicious indicators. The moderate risk score (50) is primarily driven by DNSBL listings and route instability rather than confirmed malicious activity. The subnet shows clean neighborhood data with no adjacent abuse patterns.

Recommended Action: Monitor or block based on organizational risk tolerance. No immediate threat detected.

Classification: Moderate Risk — Cloud Infrastructure

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.