54.38.147.155📋 Copy

## IP Intelligence Briefing: 54.38.147.155/32

Executive Summary

Analysis of IP address 54.38.147.155/32 reveals a cloud infrastructure endpoint operated by Ahrefs Pte Ltd Dmytro under ASN 16276 (OVH). The IP registered at risk score 40 (Moderate Risk) with evidence of recent blacklist activity. While the endpoint resolves to legitimate ahrefs.net infrastructure, geolocation validation indicates the IP is not physically located in the claimed London, England coordinates. The /24 subnet demonstrates elevated abuse density, suggesting coordinated activity within the hosting block.

Ownership and Infrastructure

Organization: Ahrefs Pte Ltd Dmytro

ASN: 16276 (OVH)

Infrastructure Type: CloudCompute, Hosting

PTR Hostname: proxy-uk005-san155.ahrefs.net

Domain: ahrefs.net

The IP operates within OVH's cloud infrastructure in the United Kingdom. DNS resolution confirms association with the ahrefs.net domain, though forward confirmation failed. No active services were observed on open ports, and the endpoint is classified as "Firewalled / No Services."

Geolocation Validation

Claimed Location: London, England, GB

Observed RTT: 87ms average, 87ms minimum

Distance from Claimed Location: 500.4 km

GeoPlausible: True

Discrepancy between claimed London coordinates and observed network latency indicates the endpoint may not be physically hosted in the United Kingdom despite PTR records suggesting UK005 infrastructure.

Threat Indicators and Reputation

Risk Score: 40 (Moderate Risk)

DNSBL Listings: 1 of 8 total lists

Threat Feed Status: No indicators

Known Campaigns: None

Most recent observation (2026-06-28) recorded blacklist listings with high severity across multiple sources. Previous observations from 2026-06-20 included port scanning activity and subnet analysis. No persistent malicious behavior detected.

Network Neighborhood Analysis

Subnet: 54.38.147.0/24

Abuse Density: 0.668 (High)

Total Siblings: 256

Active Siblings: 204

Threat Siblings: 171

The /24 subnet exhibits significant abuse density. Risk distribution across neighbors shows 45 medium-risk and 55 low-risk endpoints, with no high-risk classifications among sampled neighbors. This suggests the subnet hosts mixed legitimate and potentially compromised endpoints under shared infrastructure.

Operational Relationships

Forty-four relationships were identified, primarily classified as "Same Network" relationships pointing to OVH_282347341. The relationship graph indicates the IP shares infrastructure with multiple peers within the same hosting environment.

Recommended Security Actions

Risk Score: 40

Recommended Action: Block or monitor

Firewall rules were generated for iptables, nftables, nginx, pfSense, Cloudflare WAF, and AWS WAF platforms. The recommendation to block stems from moderate risk classification combined with recent blacklist activity.

Assessment

The IP address 54.38.147.155 represents legitimate cloud hosting infrastructure with evidence of recent abuse activity. The moderate risk score (40) and high abuse density in the /24 subnet warrant defensive monitoring rather than immediate blocking. SOC teams should evaluate incoming traffic from this IP against organizational threat intelligence policies, considering the discrepancy between claimed and observed geolocation, and the presence of blacklist listings.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.