54.38.147.170📋 Copy

# IP Intelligence Briefing: 54.38.147.170/32

Date: Current Analysis

Classification: Moderate Risk (Score: 40/100)

Status: Observational Data Compiled

---

## Executive Summary

IP address 54.38.147.170 is a cloud infrastructure address operated by Ahrefs Pte Ltd Dmytro, hosted on OVH infrastructure in London, United Kingdom. The IP presents moderate risk with no active threat indicators but operates within a high-abuse subnet environment. No direct attack campaigns or blacklist associations observed.

---

## Technical Profile

Infrastructure Classification

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Infrastructure Type: CloudCompute / Hosting
• Cloud Provider: OVH (is_cloud: true, is_hosting: true)
• Geolocation: London, England, GB (RIR: ARIN)
• BGP Prefix: 54.38.0.0/16

Network Characteristics

• DNS Resolution: proxy-uk005-san170.ahrefs.net
• PTR Record: Confirmed reverse DNS mapping
• Open Ports: None detected (firewalled/no services)
• TLS/Certificates: No TLS certificate observed
• HTTP Services: No active HTTP services detected

---

## Threat Assessment

Risk Indicators

• Overall Risk Score: 40/100 (Moderate)
• Abuse Confidence Score: Not provided
• Blacklist Status: Not listed on major threat feeds
• Known Campaigns: None associated
• Tor/Proxy/VPN: Negative indicators (not a Tor exit, proxy, or VPN)
• Threat Feeds: No threat feed matches

Neighborhood Analysis

• Subnet: 54.38.147.0/24
• Subnet Classification: High Abuse
• Abuse Density: 0.668 (66.8% of neighbors flagged)
• Threat Siblings: 171 of 256 total IPs in /24 (66.8%)
• Active Siblings: 193 IPs currently active

This IP operates within a subnet showing elevated abuse density, indicating shared infrastructure that may be co-mingled with malicious actors.

---

## Historical Observations

Recent Signal History (June 2026)

• Abuse Density Classification: Consistently classified as "high_abuse" across neighborhood assessments
• Network Classification: Stable identification as OVH cloud infrastructure (is_cloud: true, is_hosting: true)
• Geolocation Validation: Location signals indicate London, GB with plausible RTT measurements (avg 86.4ms)
• DNS Resolution: Consistent resolution to ahrefs.net domain

The IP has shown temporal stability with no ownership changes or persistent malicious behavior patterns.

---

## Relationship Mapping

Connected Entities

• Same Network: OVH infrastructure network (OVH_282347341)
• Associated Domains: ahrefs.net
• Control Plane: Route changes: 0 (30-day window); BGP prefix stable

---

## Recommended Security Actions

Firewall Rules (Recommended for Moderate Risk Assessment)

Decision Guidance

• Risk Level: Moderate (40/100)
• Blocking Recommendation: Consider blocking due to high-abuse subnet context
• Context: No direct threat indicators present, but 66.8% of subnet peers flagged as threats
• Additional Verification: Correlate with organizational policies for cloud hosting infrastructure

---

## Intelligence Summary

IP 54.38.147.170 represents a legitimate cloud hosting address within an elevated-risk subnet environment. While no active malicious indicators are present on this specific IP, the high-abuse classification of the 54.38.147.0/24 subnet warrants defensive caution. The infrastructure is operated by Ahrefs Pte Ltd on OVH cloud platforms in London.

SOC Analyst Notes:

• Monitor for lateral activity from other IPs in the 54.38.147.0/24 subnet
• Consider subnet-level blocking if threat activity escalates
• No immediate threat action required for this IP absent additional context

Classification: Defensive Security Intelligence

Data Sources: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.