54.38.147.28📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 54.38.147.28/32

Date: 2026-06-20

Classification: Moderate Risk (Score: 40/100)

---

## EXECUTIVE SUMMARY

IP address 54.38.147.28 is assigned to OVH (ASN 16276) under Ahrefs Pte Ltd Dmytro. The IP resolves to a UK-based cloud compute infrastructure (London, England) associated with the ahrefs.net domain. While no direct malicious indicators were observed, the IP exhibits elevated neighborhood risk within its /24 subnet and maintains a single DNSBL listing. Recommended for blocking at perimeter controls.

---

## OWNERSHIP AND INFRASTRUCTURE

The IP is part of the 54.38.0.0/16 BGP prefix with route stability marked as false. DNS resolution confirms the hostname proxy-uk005-san28.ahrefs.net.

---

## THREAT INDICATORS

• Risk Score: 40 (Moderate)
• DNSBL Listings: 1 of 8 total lists
• Threat Classification: No known attacker, spam source, or Tor exit node
• Abuse Confidence: Not explicitly scored
• Blacklist Count: 0 (direct)
• Control Plane Risk: Operator score 0.2174 (Minimal)

The IP shows no active threat indicators in current feeds, but maintains a single high-severity DNSBL listing observed during recent scans.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 54.38.147.0/24

Abuse Density: 0.668 (High)

Classification: high_abuse

The subnet exhibits elevated abuse activity. Risk distribution across the /24 shows 44 medium-risk and 56 low-risk neighbors, with no high-risk siblings directly observed. The target IP's neighborhood classification suggests correlation with broader subnet-level abuse patterns.

---

## OBSERVATION HISTORY

Total Observations: 19

Recent signals indicate:

• Operator Score: 0.2174 (Minimal) as of 2026-06-20
• DNSBL Listing: High severity listing observed during 2026-06-15 scan
• Domain Resolution: ahrefs.net with CAA records present
• Network Signals: Consistent routing and ownership patterns

No persistent malicious behavior detected. Threat persistence days: 0.

---

## RELATIONSHIPS

Total Relationships: 43

Primary: Same Network (OVH_282347341)

Multiple network-level relationships identified to the same OVH infrastructure block. No organizational or certificate-level relationships beyond network association.

---

## SERVICE ANALYSIS

• Open Ports: None detected
• HTTP/HTTPS: No services responding
• TLS Certificate: None
• Banner: None
• Status: Firewalled / No Services

The IP presents no active service vectors for exploitation.

---

## RECOMMENDED ACTIONS

Based on risk assessment and neighborhood correlation, the following firewall rules are recommended:

Network Perimeter

• iptables: `iptables -A INPUT -s 54.38.147.28 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 54.38.147.28 drop`

Application Layer

• nginx: `deny 54.38.147.28;`
• pfSense: `54.38.147.28/32`
• Cloudflare WAF: Block IP with expression `ip.src eq 54.38.147.28`
• AWS WAF: Add address `54.38.147.28/32` with description "IPDebrief risk 40"

Note: These recommendations should be combined with additional threat intelligence signals before implementation.

---

## ASSESSMENT

IP 54.38.147.28 represents a moderate-risk cloud infrastructure asset under OVH hosting. While no direct malicious activity was observed, the high-abuse classification of its /24 subnet warrants defensive blocking. The IP's association with legitimate hosting infrastructure (ahrefs.net) suggests potential for legitimate use, but the DNSBL listing and neighborhood risk profile justify conservative blocking at network perimeter controls.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.