54.38.147.172📋 Copy

# IP Intelligence Briefing: 54.38.147.172/32

## Executive Summary

IP address 54.38.147.172 is a moderate-risk cloud infrastructure endpoint associated with Ahrefs Pte Ltd infrastructure, hosted on OVH network (ASN 16276). The IP resides in a high-abuse density subnet with significant threat activity. Recommend monitoring or blocking based on operational context.

## Technical Profile

• Risk Score: 50 (Moderate Risk)
• Infrastructure Type: CloudCompute / Hosting
• Organization: Ahrefs Pte Ltd Dmytro
• Network: OVH_282347341, ASN 16276
• Geolocation: London, England, GB
• DNS: proxy-uk005-san172.ahrefs.net (ahrefs.net)
• Services: None detected (firewalled/no open ports)

## Threat Assessment

• Abuse Confidence: No specific indicators; subnet-level abuse density 0.668 (high_abuse classification)
• Threat Indicators: None detected in threat feeds
• Blacklist Status: 2 DNSBL listings out of 8 total lists
• Campaign Association: No known campaigns or certificate matches
• Campaign Likelihood: None

## Network Environment Analysis

Subnet 54.38.147.0/24:

• Total IPs: 256
• Active IPs: 197
• Threat-sibling IPs: 171
• Risk Classification: High abuse
• Inherited Risk Score: 26
• Operator Score: 0.4348 (Basic)

The IP shares network infrastructure with multiple related endpoints, primarily within OVH's cloud ecosystem. The subnet demonstrates elevated abuse patterns typical of shared hosting environments.

## Historical Signals

• Observation Count: 27 signals recorded
• Recent Activity: Multiple geolocation, DNS, and operator score observations from June 2026
• Route Stability: Stable (0 route changes in 30 days)
• DNSSEC: Valid with CAA records present

## Recommended Actions

Based on risk profile and neighborhood context, the following blocking rules are recommended:

Firewall Rules:

```

iptables: iptables -A INPUT -s 54.38.147.172 -j DROP

nftables: nft add rule inet filter input ip saddr 54.38.147.172 drop

nginx: deny 54.38.147.172;

```

Cloud Platform Rules:

• Cloudflare WAF: Block IP 54.38.147.172 — IPDebrief risk score 50
• AWS WAF: Add 54.38.147.172/32 to blocked addresses list
• pfSense: Block 54.38.147.172/32

## Analyst Notes

This endpoint shows no direct malicious indicators but operates within a subnet exhibiting high abuse density. The IP is associated with a legitimate hosting provider (Ahrefs) but the shared infrastructure environment increases risk exposure. SOC teams should weigh this against operational requirements before implementing blocking. Consider whitelisting if legitimate traffic from this IP is expected.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.