54.38.147.241📋 Copy

# IP Intelligence Briefing: 54.38.147.241/32

Classification: Low Risk | Risk Score: 25 | Status: Operational

---

## Executive Summary

IP address 54.38.147.241 is a cloud compute host operated by OVH (ASN 16276) for Ahrefs Pte Ltd Dmytro, located in London, England. The IP presents a low-risk profile with no active threat indicators, no blacklist listings, and no open services detected. However, the /24 subnet (54.38.147.0/24) exhibits mixed classification with elevated abuse density (0.4219), requiring contextual awareness.

---

## Technical Profile

---

## Threat Assessment

Current Indicators:

• Blacklist Status: Clean (0/8 DNSBL listings)
• Threat Feeds: No matches
• Tor/Proxy/Vpn: Not identified
• Open Ports: None detected
• Known Campaigns: None
• Abuse Confidence Score: Not applicable

Control Plane:

• BGP Prefix: 54.38.0.0/16
• Route Stability: Inconsistent (not stable)
• DNSSEC Valid: Yes
• Has CAA Record: Yes
• DNSBL Listed: 1 of 8 total lists

---

## Neighborhood Analysis

Subnet: 54.38.147.0/24

• Total Siblings: 256
• Active Siblings: 211
• Threat Siblings: 108
• Abuse Density: 0.4219 (moderate)
• Classification: Mixed

Risk Distribution in /24:

• High Risk: 0%
• Medium Risk: 75%
• Low Risk: 25%

The /24 subnet shows elevated abuse activity with 108 threat-sibling IPs identified. While the target IP (54.38.147.241) maintains a low-risk profile, analysts should monitor the subnet for potential lateral threat movement.

---

## Observation History

Total Observations: 23 signals

Recent Activity:

• 2026-06-27: Operator score 0.1, confidence 0.30
• 2026-06-26: Subnet abuse density 0.4219, confidence 0.75
• 2026-06-26: Cloud/hosting classification, confidence 0.85
• 2026-06-26: DNS resolution ahrefs.net, confidence 0.80

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: No
• Threat Observation Count: 1

The IP demonstrates stable ownership characteristics with no persistent malicious behavior detected.

---

## Recommended Actions

Firewall/Security Recommendations: No specific actions required.

SOC Analyst Guidance:

1. Allow Traffic: The IP presents a low-risk profile with no active threat indicators

2. Monitor Subnet: Be aware that 54.38.147.0/24 has mixed classification with elevated abuse density

3. No Blocking Recommended: Current signals do not warrant blocking or rate-limiting

4. Correlation: 58 relationships identified, primarily to same network (OVH_282347341)

---

## Conclusion

IP 54.38.147.241 is a legitimate cloud infrastructure host associated with Ahrefs (SEO analytics platform). While the immediate IP presents no threat, the parent subnet shows moderate abuse activity. SOC teams should maintain contextual awareness of the /24 neighborhood without taking immediate defensive action against this specific IP.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.