54.38.147.243📋 Copy

# IP Intelligence Briefing: 54.38.147.243

## Executive Summary

IP 54.38.147.243 is a cloud compute infrastructure endpoint associated with Ahrefs Pte Ltd operating under OVH cloud services. The IP carries a moderate risk score of 40 and is classified within a high-abuse density subnet. The address hosts no active services and appears to be a proxy endpoint for ahrefs.net.

## Technical Profile

• Risk Score: 40/100 (Moderate Risk)
• Provider: OVH (AS16276)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: London, England, GB (750km accuracy radius)
• Network Role: CloudCompute infrastructure
• Infrastructure Type: Cloud provider
• DNS Resolution: proxy-uk005-san243.ahrefs.net (ahrefs.net)

## Threat Indicators

• DNSBL Listings: Listed on 1 of 8 total blacklists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Indicators: None detected
• Open Ports: None detected (firewalled/no services)
• TLS/Certificates: None active

## Network Neighborhood Analysis

• Subnet: 54.38.147.0/24
• Total Siblings: 256 IPs
• Active Siblings: 193
• Threat Siblings: 160
• Abuse Density: 62.5% (High Abuse classification)
• Inherited Risk: 25/100
• Neighbor Risk Distribution: 85 medium-risk, 15 low-risk neighbors

## Control Plane Analysis

• BGP Prefix: 54.38.0.0/16
• Route Stability: Unstable (isRouteStable: false)
• Operator Score: 0.2174 (Minimal)
• RPKI State: Not reported
• Route Changes (30-day): 0
• DNSSEC: Valid

## Observation History

The IP has 22 total observations recorded. Key temporal patterns include:

• Latest Observation (2026-06-18): Confirmed high-abuse subnet classification with 62.5% abuse density
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0
• Campaign Correlation: None detected

## Intelligence Assessment

The IP address functions as a cloud-hosted proxy endpoint for ahrefs.net infrastructure. While the individual IP shows moderate risk, the subnet exhibits elevated abuse density. The absence of active services and open ports suggests this is a controlled endpoint rather than an actively exploited system. The high-abuse neighborhood indicates broader subnet-level activity that warrants monitoring.

## SOC Recommendations

1. Monitoring Priority: Medium – Monitor for anomalous traffic patterns from this subnet

2. Firewall Rules: Apply rate limiting for outbound connections to this IP

3. Threat Hunting: Investigate if traffic patterns correlate with known Ahrefs service endpoints

4. Geofencing: Consider restricting access based on London, GB geolocation if business requirements demand

5. DNSBL Monitoring: Track changes in blacklist listings for this IP

Classification: Cloud Infrastructure – Moderate Risk

Last Updated: 2026-06-18

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.