54.37.118.90📋 Copy

## IP INTELLIGENCE BRIEFING

Target IP: 54.37.118.90/32

Classification: Moderate Risk

Date: Current Intelligence Cycle

---

EXECUTIVE SUMMARY

IP 54.37.118.90 is a cloud infrastructure asset operated by OVH within the Ahrefs Pte Ltd Dmytro organization. The IP carries a risk score of 40 (Moderate Risk) and is associated with the 54.37.0.0/16 BGP prefix under ASN 16276. While no active threat indicators are present, the IP resides in a high-abuse-density subnet (54.37.118.0/24) with 25 of 32 sibling IPs exhibiting threat characteristics.

---

OWNERSHIP AND GEOLOCATION

---

THREAT INDICATORS

• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Known Campaigns: None correlated
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False
• DNSBL Listings: 1 of 8 total lists
• Threat Feeds: No active indicators
• DNSBL Listed Count: 1

---

NETWORK INFRASTRUCTURE

• Infrastructure Type: CloudCompute
• Connection Type: Cloud-hosted
• Services Detected: None (Firewalled / No Services)
• Open Ports: None
• Reverse DNS: proxy-fr000-san90.ahrefs.net
• Forward Resolution: proxy-fr000-san90.ahrefs.net
• Domain Association: ahrefs.net
• Infrastructure Classification: Hosting environment with no active services

---

NEIGHBORHOOD ANALYSIS (54.37.118.0/24)

• Total Sibling IPs: 32
• Active Siblings: 23
• Threat Siblings: 25
• Abuse Density: 0.7812 (High Abuse Classification)
• Inherited Risk Score: 31
• Risk Distribution: 0 High / 31 Medium / 0 Low
• Neighbor Risk Scores: Consistently 40-50 across all observed IPs

The subnet exhibits elevated abuse characteristics. All 31 observed neighbors maintain risk scores between 40-50 with authority scores at 50, indicating consistent cloud infrastructure usage with moderate risk profiles.

---

OBSERVATION HISTORY

Total observations: 19 signals

• Recent Activity: June 2026 timeframe
• Ownership Changes: 0 changes detected
• Threat Persistence: 0 days
• Threat Observation Count: 1
• Persistently Malicious: False
• Control Plane Stability: Route changes recorded within 30-day window
• DNSSEC Status: Valid
• CAA Records: Present

The IP shows minimal temporal volatility with no persistent malicious activity detected. Signals indicate stable ownership with periodic monitoring across subnet abuse density, operator scoring, and multi-dimensional risk assessments.

---

SECURITY ACTIONS AND RECOMMENDATIONS

Risk-Based Classification: Moderate Risk (Score 40)

Recommended Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 54.37.118.90 -j DROP

# nftables

nft add rule inet filter input ip saddr 54.37.118.90 drop

# nginx

deny 54.37.118.90;

# pfSense

54.37.118.90/32

# Cloudflare WAF

{"description":"Block 54.37.118.90 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 54.37.118.90"}}

# AWS WAF

{"Addresses":["54.37.118.90/32"],"Description":"IPDebrief risk 40"}

```

Action Notes: No specific security action recommendations generated. The IP is classified as moderate risk with no active threat indicators. Blocking should be considered based on organizational risk tolerance and correlation with other traffic analysis signals.

---

INTELLIGENCE CONCLUSIONS

1. Legitimate Cloud Infrastructure: The IP operates within OVH cloud hosting infrastructure associated with Ahrefs, a known search engine marketing tool provider.

2. Subnet Context: The 54.37.118.0/24 subnet demonstrates high abuse density (0.7812), suggesting shared infrastructure usage patterns typical of cloud environments.

3. No Active Threats: No blacklist entries, known campaigns, or threat indicators detected.

4. Monitoring Recommendation: While the IP is not actively malicious, the elevated neighborhood abuse density warrants continued monitoring, particularly for anomalous traffic patterns.

---

*Report generated from IPDebrief intelligence platform. All data sourced from real-time network observation and analysis.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.