54.38.147.173
# IP INTELLIGENCE BRIEFING: 54.38.147.173
Classification: Moderate Risk | Risk Score: 50/100 | Status: Cloud Infrastructure
---
## EXECUTIVE SUMMARY
IP address 54.38.147.173 is a cloud-compute endpoint operated by OVH SAS (ASN 16276) within a high-abuse-density subnet. The IP hosts a proxy service for the ahrefs.net domain and exhibits moderate-risk characteristics due to neighborhood abuse patterns. No active threat indicators or malicious campaign associations were identified.
---
## OWNERSHIP & INFRASTRUCTURE
- Organization: Ahrefs Pte Ltd Dmytro
- ASN: AS16276 (OVH SAS)
- Infrastructure Type: Cloud Compute (hosting enabled)
- Geolocation: London, England (GB) / France (FR) — conflicting data sources
- BGP Prefix: 54.38.0.0/16 (RouteStable: FALSE)
---
## NETWORK CLASSIFICATION
- Service Purpose: Firewalled / No Services
- Open Ports: None detected
- TLS Certificate: Not present
- CDN/Proxy/VPN: Not classified as CDN, proxy, or VPN
- DNS: proxy-uk005-san173.ahrefs.net (forward confirmed: FALSE)
---
## THREAT ASSESSMENT
| Indicator | Finding |
|---|---|
| Is Known Attacker | NO |
| Is Spam Source | NO |
| Is Tor Exit Node | NO |
| Blacklist Count | 0 |
| Abuse Confidence | Not available |
Control Plane Data: 2 DNSBL listings out of 8 total lists (operatorScore: 0.2174). DNSSEC valid. No certificate matches or banner matches to known campaigns.
---
## NEIGHBORHOOD ANALYSIS
Subnet: 54.38.147.0/24
- Abuse Density: 0.625 (HIGH)
- Total Siblings: 256
- Active Siblings: 193
- Threat Siblings: 160
- Risk Distribution: Medium (85), Low (15), High (0)
The subnet demonstrates significant abuse density with 160 threat-sibling IPs, indicating the broader network may contain compromised or misconfigured endpoints.
---
## OBSERVATION HISTORY
Recent signals (June 14–18, 2026):
- Geolocation: Conflicting reports between GB and FR
- Routing: Operator score 0.2174 (minimal)
- Subnet Classification: High abuse (abuseDensity: 0.625)
- Threat Persistence: Single observation (0 days) — not persistently malicious
---
## RECOMMENDED ACTIONS
1. Monitoring: Add to monitoring list for outbound traffic analysis due to high-abuse neighborhood
2. Firewall: No explicit block recommended — IP not flagged as known malicious
3. DNS: Monitor for DNS-based anomalies given firewalled status
4. Contextual: Investigate if traffic originates from or targets ahrefs.net domain
---
Note: No specific firewall rules or blocking recommendations are generated for this IP. The moderate risk score is primarily driven by neighborhood abuse density rather than direct malicious indicators.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Ahrefs Pte Ltd Dmytro |
| ASN | AS16276 |
| Network Name | — |
| CIDR Block | — |
| RIR | ARIN |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | proxy-uk005-san173.ahrefs.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | proxy-uk005-san173.ahrefs.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 33% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 12% | 2 | 2 |
| ownership | 20% | 2 | 3 |
| reputation | 28% | 1 | 3 |
| geolocation | 32% | 2 | 3 |
| Overall | 23% | 10 | 16 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-07 23:04:28 UTC |
| Last Seen | 2026-06-27 07:52:09 UTC |
| Profile Built | 2026-06-28 01:57:32 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 28 |
Full dossier details are available via our API.