54.37.118.79📋 Copy

# IP Intelligence Briefing: 54.37.118.79

## Executive Summary

IP 54.37.118.79 is a moderate-risk (Score: 40) cloud-hosting address registered to OVH France. The IP resolves to the Ahrefs proxy infrastructure (proxy-fr000-san79.ahrefs.net) and shows evidence of DNSBL listings with high-severity classifications. The surrounding /24 subnet exhibits elevated abuse density, warranting network-level monitoring.

## Ownership and Infrastructure

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: France (FR), Europe/Paris timezone
• Infrastructure Type: CloudCompute/Hosting
• CIDR Block: 54.37.0.0/16

## DNS and Service Profile

• PTR Hostname: proxy-fr000-san79.ahrefs.net
• Forward Resolution: proxy-fr000-san79.ahrefs.net (not confirmed)
• Open Ports: None detected
• Services: Firewalled/No Services active
• DNSSEC: Valid
• CAA Records: Present

## Threat Indicators

• DNSBL Listings: 1 out of 8 total lists
• Abuse Confidence: Not quantified
• Known Attacker: No
• Tor Exit Node: No
• Known Campaigns: None identified
• Threat Feeds: No active matches

## Neighborhood Analysis (54.37.118.0/24)

• Abuse Density: 0.625 (High Abuse Classification)
• Total Siblings: 32
• Active Siblings: 26
• Threat Siblings: 20
• Inherited Risk: 25
• Risk Distribution: 0 High, 9 Medium, 22 Low

The /24 subnet shows significant peer risk, with 20 of 32 sibling IPs flagged as threats. This suggests OVH hosting environment with mixed-use traffic patterns.

## Historical Observations

• Total Observations: 25
• Ownership Stability: 0 changes (stable)
• Recent Classifications: Cloud infrastructure with OVH provider designation
• Threat Persistence: No persistent malicious activity detected

Recent observations indicate consistent cloud hosting classification with provider attribution to OVH. DNSBL listings have appeared with high-severity ratings.

## Relationship Graph

• Total Relationships: 46
• Primary Classification: Same Network (OVH_282114225)

Multiple network-level associations point to consolidated OVH infrastructure hosting.

## Recommended Actions

1. Monitor: Track DNSBL listing status and severity changes

2. Block: Consider blocking at perimeter if traffic is unexpected

3. Monitor: Watch for lateral movement from high-risk sibling IPs in /24

4. Investigate: Correlate with Ahrefs proxy infrastructure activities

## Risk Assessment

This IP represents moderate risk with elevated neighborhood context. The combination of hosting infrastructure, DNSBL presence, and high-abuse-density subnet requires SOC monitoring. No immediate threat indicators beyond standard hosting environment noise.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.