54.38.147.175📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 54.38.147.175/32

Classification: Low Risk / Hosting Infrastructure

Generated: 2026-06-27

---

## EXECUTIVE SUMMARY

IP 54.38.147.175 is a cloud-based hosting endpoint operated by OVH (ASN 16276) in London, UK, associated with Ahrefs Pte Ltd. The IP exhibits a risk score of 25 (Low Risk) and is currently firewalled with no active services. While the individual IP shows minimal direct threat indicators, the /24 neighborhood demonstrates elevated abuse density (41.41%), warranting contextual monitoring.

---

## OWNERSHIP & GEOLOCATION

DNS Resolution:

• PTR Hostname: `proxy-uk005-san175.ahrefs.net`
• Domain: `ahrefs.net`
• Forward resolution confirmed: No

---

## THREAT ASSESSMENT

Direct Threat Indicators

• Abuse Confidence Score: None (null)
• Blacklist Status: Listed on 1 of 8 DNSBL feeds
• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Neighborhood Analysis

• Subnet: 54.38.147.0/24
• Abuse Density: 41.41% (Elevated)
• Threat Siblings: 106 out of 256 total IPs
• Classification: Mixed (106 high-risk, 76 medium-risk, 24 low-risk)
• Inherited Risk Score: 16

---

## NETWORK BEHAVIOR & SERVICES

• Open Ports: None detected
• HTTP Services: None active
• TLS Certificates: None
• Server Banners: None
• Network Role: Firewalled / No Services
• Connection Type: Cloud infrastructure

---

## OBSERVATION HISTORY (Last 24 Signals)

Recent monitoring indicates mixed signal activity:

1. 2026-06-27 14:04: Threat listings detected across 8 blacklists, 2 active listings with high severity rating

2. 2026-06-25 09:58: Provider classification confirmed as OVH cloud infrastructure

3. 2026-06-25 09:56: Neighborhood abuse density assessment at 41.41%

4. 2026-06-25 09:50: Control plane operator score rated as "Minimal" (0.1)

Trend: Single threat observation recorded; no persistent malicious activity detected.

---

## RELATIONSHIP GRAPH

• Total Relationships: 65 identified
• Primary Network: OVH_282347341 (same network)
• Related Hostnames: proxy-uk005-san175.ahrefs.net
• Organizational Links: Ahrefs ecosystem

---

## RECOMMENDATIONS

Firewall Rules

No specific firewall rules generated. Current risk profile does not warrant blocking.

Monitoring Priority

• Status: Monitor
• Rationale: Low-risk individual IP with elevated neighborhood abuse density
• Action: Log and monitor for unusual outbound connections or service changes

Contextual Notes

• The IP resolves to Ahrefs infrastructure, a legitimate SEO analytics platform
• High neighborhood abuse density is common for OVH cloud hosting environments
• DNSBL listing requires periodic review but does not indicate active malicious use

---

## ANALYST NOTES

This IP belongs to a legitimate hosting provider (OVH) with documented association to Ahrefs. The single DNSBL listing may be a false positive or related to historical activity. The /24 neighborhood shows typical density for cloud hosting environments. SOC analysts should monitor for any deviation from expected hosting behavior patterns.

Confidence Level: High

Threat Level: Low

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.