54.38.147.17📋 Copy

IP Intelligence Briefing: 54.38.147.17

Date: 2026-06-06

---

**1. Core Profile**

• Reputation: Moderate Risk (Risk Score: 50)
• Ownership:

- ASN: 16276

- Organization: Ahrefs Pte Ltd (Dmytro)

- Geolocation: London, England, UK

• Network Role:

- CloudCompute infrastructure (OVH provider)

- Firewalled / No Services exposed

- Hosting provider: OVH

---

**2. Threat & Risk Analysis**

• Threat Indicators:

- No direct malicious indicators (no blacklists, spam, or known attacker tags).

- Subnet abuse density: 0.36 (moderate risk in the 54.38.147.0/24 network).

• Historical Observations:

- Risk scores consistently labeled as "Minimal" over the last 30 days.

- Stability score: 0 (no recent changes in network behavior).

---

**3. Network Relationships**

• Linked Entities:

- Subnet: 54.38.147.0/24 (mixed classification, 93 threat siblings).

- BGP Prefix: 54.38.0.0/16 (OVH ASN 16276).

- DNS: Resolves to proxy-uk005-san17.ahrefs.net (Ahrefs infrastructure).

• Neighbors:

- Subnet contains 100 IPs, with 17 medium-risk and 83 low-risk siblings.

- Notable neighbors:

- 54.38.147.2 (Risk Score: 50)

- 54.38.147.4 (Risk Score: 25)

---

**4. Behavioral & Technical Insights**

• Services: No open ports or TLS certificates detected.
• DNS:

- PTR hostname: proxy-uk005-san17.ahrefs.net

- No email authentication records (SPF/DKIM).

• Routing:

- BGP route stability: Unstable (routeChanges30d: 0, isRouteStable: false).

- DNSSEC and CAA records validated.

---

**5. Recommendations**

• Monitoring:

- Track subnet abuse density (54.38.147.0/24) for potential lateral movement.

- Monitor DNS activity for unusual queries or domain changes.

• Access Control:

- Restrict access to this subnet if it contains sensitive assets.

- Consider blocking medium-risk neighbors (e.g., 54.38.147.2) to mitigate risk.

• Investigation:

- Verify if Ahrefs infrastructure is involved in any known campaigns.

- Validate BGP route stability and potential route hijacking risks.

Conclusion: This IP is part of a cloud-hosted, firewalled network with no direct malicious activity. However, its subnet contains moderate-risk neighbors, warranting closer scrutiny for potential indirect threats.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.