54.38.147.248📋 Copy

IP INTELLIGENCE BRIEFING: 54.38.147.248

SUMMARY

The target IP 54.38.147.248 is assigned to OVH SAS (ASN 16276) with ownership attributed to Ahrefs Pte Ltd Dmytro. The IP is geolocated to London, England, but historical geolocation signals have also indicated French infrastructure. The IP resolves to proxy-uk005-san248.ahrefs.net and operates as a cloud computing instance with no open services detected (firewalled).

RISK ASSESSMENT

Current risk score: 40 (Moderate Risk). The IP is listed on 8 DNSBLs with 1 active listing (high severity). Control plane analysis shows 1 DNSBL listing across 8 total lists. The subnet (54.38.147.248/24) exhibits high abuse density (0.668) with 171 threat siblings out of 256 total IPs.

NETWORK INFRASTRUCTURE

• ISP/Provider: OVH (Infrastructure-as-a-Service Cloud Computing)
• Network Role: Hosting provider with firewalled/no-services configuration
• DNS Records: Single PTR record pointing to aproxy hostname in the ahrefs.net domain
• Geolocation Consensus: Inconsistent (current: GB, historical: FR)

THREAT INDICATORS

• Malicious Activity: No known attacker indicators, not a Tor exit node, not a known spam source
• Campaigns: No known campaign associations
• Threat Feeds: No active threat feed matches
• Abuse Confidence: Listed on threat intelligence platforms

OBSERVATION HISTORY

Twenty-two signals observed since initial detection. Recent activity includes:

• June 2026: Listed on multiple threat intelligence sources with high severity classifications
• Historical signals from June 2026 show OVH infrastructure with 6 pulse matches
• Subnet abuse density consistently rated as "high_abuse" across observation period
• No persistent malicious behavior detected over time

RELATIONSHIP ANALYSIS

Forty relationships identified, predominantly network-level associations with OVH_282347341. The IP shares its /24 subnet with 197 active sibling IPs, with risk scores ranging from 25-50 across the neighborhood.

RECOMMENDED ACTIONS

Given the moderate risk classification and subnet abuse density, consider blocking this IP:

• Firewall Rules: iptables/nftables DROP rule recommended
• WAF: Cloudflare WAF and AWS WAF blocking rules available
• Web Servers: Nginx deny directive recommended

ASSESSMENT

This IP presents moderate risk primarily due to subnet-level abuse patterns rather than confirmed malicious activity at the individual address level. The hosting nature of the infrastructure (OVH cloud) combined with the high-abuse subnet classification warrants monitoring and potential blocking depending on organizational security policies.

INTELLIGENCE CONCLUSION

IP 54.38.147.248 is a cloud-hosted address associated with Ahrefs infrastructure, located in London but with inconsistent geolocation reporting. While no direct malicious activity is confirmed, the subnet's high abuse density and DNSBL listings suggest this address may be part of compromised or misconfigured infrastructure. Recommended for monitoring and conditional blocking.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.