54.38.147.235📋 Copy

## IP Intelligence Briefing: 54.38.147.235/32

Classification: Moderate Risk (Score: 40)

Report Generated: 2026-06-20

Intel Level: SOC Actionable

---

Executive Summary

IP 54.38.147.235 is a cloud-hosted endpoint located in London, England, registered to Ahrefs Pte Ltd under ASN 16276 (OVH). The IP shows moderate risk (40) with no direct threat indicators, but operates within a high-abuse-density subnet (/24) containing 171 malicious siblings out of 193 active peers. The endpoint resolves to the ahrefs.net domain but presents no open services.

---

Technical Profile

Ownership & Infrastructure:

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• RIR: ARIN
• Infrastructure: CloudCompute, Hosting
• Location: London, England, GB (Europe/London timezone)
• CIDR Block: 54.38.0.0/16

Network Role:

• Cloud Hosted: Yes
• CDN/Proxy/VPN: No
• Mobile/Residential: No
• Bogon: No

DNS Configuration:

• PTR Hostname: proxy-uk005-san235.ahrefs.net
• Forward Resolution: 1 hostname (ahrefs.net)
• DNSSEC: Valid
• CAA Records: Present

Services:

• Open Ports: None detected
• TLS Certificates: None
• HTTP Banner: None
• Classification: Firewalled / No Services

---

Threat Intelligence

Risk Assessment:

• Overall Risk Score: 40 (Moderate)
• Abuse Confidence Score: Not applicable
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No

Blacklist Status:

• Blacklist Count: 0 (direct)
• DNSBL Listed: 1 of 8 total lists
• DNSBL Listing: High severity on one list

Subnet Environment:

• Subnet: 54.38.147.0/24
• Abuse Density: 0.668 (High)
• Classification: High Abuse
• Threat Siblings: 171 out of 193 active peers
• Inherited Risk Score: 26

Behavioral Indicators:

• Route Stability: False
• Threat Persistence: 0 days observed
• Persistent Malicious Activity: No

---

Observation History (Recent 20 Signals)

Latest Signals (2026-06-20):

• 08:04:01 – Port scan detected (confidence: 0.70)
• 07:49:16 – DNS resolution to ahrefs.net with CAA records (confidence: 0.80)
• 07:23:03 – Cloud infrastructure classification: OVH (confidence: 0.90)
• 07:22:55 – Listed on 8 DNSBLs, 1 at high severity (confidence: 0.85)
• 07:22:49 – Subnet abuse classification: high_abuse (confidence: 0.75)

---

Relationship Graph

Network Relationships:

• 37 total relationships identified
• Primary association: OVH_282347341 (Same Network)
• Multiple entries indicate infrastructure clustering

Correlated Entities:

• No direct correlation to known campaigns
• Zero certificate matches
• Zero correlated IPs beyond network relationships

---

Recommended Actions

Immediate Mitigation:

```bash

# iptables

iptables -A INPUT -s 54.38.147.235 -j DROP

# nftables

nft add rule inet filter input ip saddr 54.38.147.235 drop

```

WAF/Proxy Rules:

• Cloudflare WAF: Block IP 54.38.147.235 (risk score 40)
• AWS WAF: Add 54.38.147.235/32 to deny list
• pfSense: 54.38.147.235/32 block rule
• nginx: `deny 54.38.147.235;`

Analysis Notes:

While the IP shows no direct malicious activity, the subnet environment exhibits elevated abuse density (0.668). Blocking is recommended as a precautionary measure given the high concentration of malicious peers in the /24 block. Monitor for any service changes or port openings that may indicate compromise.

---

Disclaimer: Intelligence derived from automated analysis. Verify with additional telemetry before operational decisions.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.