37.59.204.143📋 Copy

# IP Intelligence Briefing: 37.59.204.143/32

## Executive Summary

IP 37.59.204.143 presents as a cloud-hosted infrastructure endpoint associated with Ahrefs Pte Ltd Dmytro (ASN 16276, OVH provider). The IP carries a moderate risk score of 40 and is classified as "high_abuse" within its subnet. While the endpoint itself shows no active threat indicators, the surrounding neighborhood exhibits significant abuse density (0.7188), suggesting potential infrastructure sharing with malicious actors.

## Infrastructure Profile

• IP Address: 37.59.204.143/32
• Provider: OVH (ASN 16276)
• Organization: Ahrefs Pte Ltd Dmytro
• Country: France (FR)
• Infrastructure Type: CloudCompute
• DNS Resolution: proxy-fr007-san143.ahrefs.net
• Network Classification: Cloud hosting infrastructure, no active services detected

## Risk Assessment

• Overall Risk Score: 40 (Moderate Risk)
• Abuse Confidence Score: Not available
• Blacklist Count: 0
• DNSBL Listings: 1 out of 8 total lists
• Operator Score: 0.2174 (Minimal)
• Threat Indicators: None currently detected
• Known Campaigns: None identified

The IP resolves to an Ahrefs-owned proxy hostname but operates within a high-abuse-density subnet. This mismatch between legitimate domain ownership and neighborhood risk profile warrants monitoring.

## Neighborhood Analysis (37.59.204.0/24)

• Total Siblings: 32 IPs
• Active Siblings: 12
• Threat Siblings: 23
• Abuse Density: 0.7188 (High)
• Risk Distribution: 28 medium-risk, 3 low-risk, 0 high-risk neighbors

The subnet demonstrates elevated abuse characteristics. The IP shares a network segment with 23 threat-siblings, indicating potential infrastructure co-location with known malicious actors.

## Observation History

Analysis of 23 historical observations reveals:

• Recent operator score assessments indicate "Minimal" risk classification
• One high-severity DNSBL listing detected on 2026-06-23
• Geolocation data validated with 97ms average RTT from France
• No persistent malicious behavior observed (threat persistence days: 0)
• Route stability flagged as false despite zero BGP changes in 30 days

## Network Relationships

The IP maintains connections within the OVH_282114232 network relationship cluster. Multiple same-network associations indicate broader infrastructure relationships within the OVH provider ecosystem.

## Recommended Actions

1. Monitor traffic patterns between 37.59.204.143 and adjacent threat-sibling IPs in the /24 subnet

2. Review firewall rules for this subnet given the 0.7188 abuse density

3. Correlate with Ahrefs infrastructure baseline to confirm legitimate vs. compromised usage

4. Track DNSBL listing changes and assess impact on reputation services

5. Evaluate whether cloud hosting classification masks malicious backend infrastructure

## Conclusion

IP 37.59.204.143 currently operates as legitimate cloud infrastructure without active threat indicators. However, the high-abuse-density environment and proximity to 23 threat-siblings suggest potential for infrastructure sharing with malicious entities. SOC teams should monitor for anomalous outbound connections and cross-reference with known Ahrefs security baselines.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.