15.235.27.110📋 Copy

# IP INTELLIGENCE BRIEFING: 15.235.27.110/32

Classification: Moderate Risk | Date: 2026-06-28

---

## EXECUTIVE SUMMARY

IP address 15.235.27.110 operates within OVH cloud infrastructure under Ahrefs Pte Ltd ownership. The address demonstrates a moderate risk score of 40 and is classified as a cloud-hosted proxy with no active services. The associated /24 subnet exhibits elevated abuse density (0.6406), with 164 of 256 sibling IPs flagged as threats. No direct malicious indicators or active threat campaigns were detected.

---

## OWNERSHIP AND INFRASTRUCTURE

• Owner: Dmytro, Ahrefs Pte Ltd
• ASN: 16276 (OVH)
• Network: OVH-CUST-281059692
• CIDR Block: 15.235.0.0/17
• Infrastructure Type: CloudCompute (Hosting)
• Connection Type: Cloud-based infrastructure

The IP resolves to the Ahrefs.net domain (proxy-ca013-san110.ahrefs.net), indicating legitimate search engine marketing tool infrastructure.

---

## GEOLOCATION VALIDATION

• Reported Location: Singapore
• Country Code: CA
• RTT Validation: ANOMALY DETECTED
• Minimum Possible RTT: 121.6ms
• Observed RTT: 27ms
• Distance Violation: 6082km

Geolocation data shows a significant RTT discrepancy, suggesting either misreported location data or potential infrastructure misconfiguration.

---

## THREAT INDICATORS

• Risk Score: 40 (Moderate)
• Threat Indicators: None detected
• Known Campaigns: None
• Is Tor Exit: False
• Is Known Attacker: False
• Is Spam Source: False
• DNSBL Lists: 1 of 8 total listings
• Blacklist Count: 0

No active threat indicators were observed. The single DNSBL listing warrants monitoring but does not indicate confirmed malicious activity.

---

## NETWORK ROLE AND SERVICES

• Provider: OVH
• Is Cloud: Yes
• Is CDN: No
• Is Proxy: No (classified as hosting)
• Is Tor: No
• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Service Status: Firewalled / No Services

The IP has no open services detected, functioning as a firewalled endpoint.

---

## SUBNET ANALYSIS (15.235.27.0/24)

• Abuse Density: 0.6406 (High abuse classification)
• Total Sibling IPs: 256
• Active Siblings: 211
• Threat Siblings: 164
• Risk Distribution: 53 medium risk, 47 low risk

The /24 subnet shows significant abuse activity. The high abuse density (0.64) indicates this network segment is frequently associated with malicious activity, suggesting potential collateral risk for neighboring IPs.

---

## OBSERVATION HISTORY

Analysis of 20 observations from June 2026 reveals:

• Consistent Cloud Profile: All observations confirm OVH cloud hosting infrastructure
• Operator Score: 0.2174 (Minimal)
• Threat Persistence: 0 days (No persistent malicious behavior)
• Ownership Changes: 0 (Stable ownership)
• DNS Records: Ahrefs.net domain with CAA records present
• DNSSEC: Valid

The IP has maintained a stable, non-malicious profile throughout the observation window.

---

## RELATIONSHIP GRAPH

• Total Relationships: 35
• Primary Network: OVH-CUST-281059692 (30+ same network entries)
• Domain Association: ahrefs.net
• Network Classification: Cloud customer network

All relationships indicate legitimate cloud infrastructure associations with no malicious network connections.

---

## RECOMMENDED SECURITY ACTIONS

Firewall Rules

Risk Assessment

Given the moderate risk score (40) and the subnet's high abuse density (0.6406), blocking this IP is recommended for defensive posture. However, the IP's association with legitimate Ahrefs infrastructure requires consideration of business context before implementation.

---

## CONCLUSION

IP 15.235.27.110 is a cloud-hosted Ahrefs proxy endpoint with moderate risk characteristics. The subnet's high abuse density suggests monitoring of associated IPs. No direct threat indicators were detected. The geolocation anomaly (RTT violation) warrants additional verification. Blocking is recommended due to subnet abuse profile, though legitimate use cases may exist.

Threat Level: MODERATE

Action Required: MONITOR OR BLOCK (context-dependent)

---

*Report generated: 2026-06-28*

*Data source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.