54.38.147.75📋 Copy

INTELLIGENCE BRIEFING: 54.38.147.75/32

Classification: MODERATE RISK

Date: Current

Data Sources: IPDebrief Intelligence Platform

---

**EXECUTIVE SUMMARY**

IP 54.38.147.75 is a cloud compute address associated with OVH infrastructure (ASN 16276) in London, GB. The IP carries a risk score of 40 (Moderate Risk) with no active threat indicators. The subnet 54.38.147.0/24 demonstrates elevated abuse density (0.5039), classifying it as high_abuse. The IP resolves to aresolvable hostname proxy-uk005-san75.ahrefs.net, indicating legitimate web infrastructure usage.

---

**TECHNICAL PROFILE**

Ownership & Network:

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• RIR: ARIN / RIPE
• CIDR Block: 54.38.0.0/16 (BGP prefix)
• Infrastructure Type: Cloud Compute
• Network Classification: Yes

Geolocation:

• Country: GB (England)
• City: London
• Accuracy Radius: 750 km
• RTT: 87-90 ms (plausible)

DNS & Services:

• PTR Hostname: proxy-uk005-san75.ahrefs.net
• Forward Resolution: Confirmed
• Open Ports: None detected (firewalled/no services exposed)
• TLS Certificates: None
• Email Auth (SPF/DMARC): Not configured

Control Plane:

• Route Stability: Stable (0 route changes in 30 days)
• DNSSEC: Valid
• DNSBL Listed: 1 of 8 lists
• RPKI State: Not validated

---

**THREAT ASSESSMENT**

Risk Indicators:

• Overall Risk Score: 40 (Moderate)
• Abuse Confidence Score: Not applicable
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Associations: None detected

Neighborhood Analysis (54.38.147.0/24):

• Subnet Classification: High Abuse
• Abuse Density: 0.5039 (50.39%)
• Active Siblings: 168 of 256 total
• Threat Siblings: 129
• Risk Distribution: 94 Medium, 6 Low, 0 High

Temporal Behavior:

• 26 historical observations recorded
• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 1
• Persistently Malicious: No

---

**RELATIONSHIP GRAPH**

45 relationships identified, primarily same-network associations with OVH_282347341 subnet. No organizational or hostname relationships beyond the ahrefs.net domain.

---

**RECOMMENDED SECURITY ACTIONS**

Firewall Rules:

• iptables: `iptables -A INPUT -s 54.38.147.75 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 54.38.147.75 drop`
• Nginx: `deny 54.38.147.75;`
• pfSense: `54.38.147.75/32`

WAF Recommendations:

• Cloudflare WAF: Block with expression `ip.src eq 54.38.147.75`
• AWS WAF: Add to address set `54.38.147.75/32`

Rationale: While the IP is not actively malicious, the high-abuse subnet classification and moderate risk score warrant defensive blocking. The IP shows no open services but exists in a high-density abuse environment.

---

**INTELLIGENCE NOTES**

• The IP resolves to legitimate Ahrefs infrastructure, suggesting commercial use
• No evidence of active exploitation or malicious activity
• Subnet-level risk inheritance applies (129 threat-sibling IPs in /24)
• Monitor for any service changes or DNS modifications
• Consider subnet-level monitoring given high abuse density

---

*Report generated from IPDebrief intelligence platform data. Recommendations should be validated against organizational context before implementation.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.