54.38.147.87📋 Copy

# INTELLIGENCE BRIEFING: IP 54.38.147.87/32

Classification: Moderate Risk (Score: 40/100)

Date: 2026-06-28

Analyst: IPDebrief Intelligence

---

## EXECUTIVE SUMMARY

IP address 54.38.147.87 operates within OVH cloud infrastructure and is associated with Ahrefs Pte Ltd. Current risk assessment indicates moderate risk (40/100) with no active threat indicators. However, historical observation data reveals elevated abuse density (0.6328) and high-abuse subnet classification. The IP maintains stable ownership under legitimate organization but exhibits behavioral patterns warranting monitoring.

---

## OWNERSHIP & INFRASTRUCTURE

Organization: Ahrefs Pte Ltd Dmytro

ASN: AS16276 (OVH SAS)

Geolocation: London, England, GB (500.4km probe distance)

Infrastructure Type: CloudCompute / Hosting

CIDR Block: 54.38.0.0/16 (BGP Origin)

DNS Resolution: proxy-uk005-san87.ahrefs.net

Forward Confirmation: Failed (0.75 confidence)

SSL/TLS: No active certificates detected

---

## THREAT INDICATORS

Current Status: No active threats detected

Blacklist Status: Listed on 1 of 8 DNSBL feeds

Threat Feeds: Empty

Campaign Correlation: None (0 cert matches, 0 correlated IPs)

Known Campaigns: None

Control Plane:

• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not verified
• Route Changes (30d): 0
• DNSSEC: Valid

---

## NETWORK CONTEXT

Subnet Abuse Density: 0.6328 (High Abuse Classification)

Subnet Size: /24 (256 total IPs)

Active Siblings: 193/256 (75.4%)

Threat Siblings: 162/256 (63.3%)

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 71
• Low Risk: 29

The IP resides in a high-abuse density subnet with 63% of sibling IPs flagged as threats. Inherited risk score: 25/100.

---

## OBSERVATION HISTORY (22 Signals)

Recent Activity:

• 2026-06-28: Geolocation probe (London, 500.4km distance, 91.2ms avg RTT)
• 2026-06-20: Abuse density classification (0.6328, high_abuse)
• 2026-06-20: Alienvault OTX signal with threat indicators (5 pulses)
• 2026-06-20: Operator score: 0.2174 (Minimal)
• 2026-06-20: Overall confidence: 0.2473

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Persistently Malicious: False
• Threat Observation Count: 1

---

## NETWORK SERVICES

Open Ports: None detected

HTTP Services: No active HTTP title or banner

Email Reputation: No scoring data available

Honeypot Hits: 0

---

## RECOMMENDED ACTIONS

Risk Score: 40/100 (Moderate Risk)

Status: No specific recommendations generated

Firewall Rule Recommendations:

---

## ASSESSMENT

IP 54.38.147.87 presents a moderate risk profile within a high-abuse density subnet. While associated with legitimate organization Ahrefs Pte Ltd, the subnet's 63% threat sibling ratio suggests potential for abuse. The IP shows no current active threat indicators but maintains historical abuse classifications. Recommend monitoring for service activation and correlating with ongoing threat intelligence. No immediate blocking required unless additional threat signals emerge.

---

Generated by: IPDebrief Intelligence Platform

Data Sources: 22 historical observations, 56 relationship links, 100 neighbor records

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.