15.235.27.132📋 Copy

IP Intelligence Briefing: 15.235.27.132

Date: 2026-06-16

---

**1. Core Profile**

• Risk Assessment: Moderate Risk (Risk Score: 50/100). No direct malicious indicators (no malware, phishing, or known campaigns).
• Ownership:

- ASN: 16276 (OVH)

- Organization: Dmytro, Ahrefs Pte Ltd (OVH-CUST-281059692)

- Geolocation: Registered to Singapore (CA), but geo-validation is not plausible (potential spoofing or misconfiguration).

• Network Role: CloudCompute infrastructure (OVH-hosted). No open ports, no TLS services, no HTTP banners.
• DNS: Linked to `proxy-ca013-san132.ahrefs.net` (Ahrefs, a legitimate SEO tool). No DNS-based threats detected.

---

**2. Threat & Behavior**

• Threat Indicators:

- No known spam, attacker, or Tor exit node associations.

- High Abuse Subnet: 15.235.27.0/24 has 66.8% abuse density (171/256 IPs flagged as threats).

- Neighbor Risk: 100 neighbors analyzed; 98 medium/low risk, 2 high risk.

• Observation History:

- Recent signals show high abuse classification (0.668 density), but no persistent malicious activity.

- Operator score: Minimal (0.2174), but subnet instability (route changes) detected.

---

**3. Relationships & Context**

• Network Associations:

- Same subnet as OVH-CUST-281059692 (Ahrefs).

- DNS ties to `proxy-ca013-san132.ahrefs.net` (likely a legitimate proxy service).

• DNS & Certificates:

- No TLS certificates or HTTP services detected.

- DNSSEC and CAA records validated, but no email authentication (SPF/DKIM) found.

---

**4. Recommendations**

• Monitor Subnet: High abuse density in 15.235.27.0/24 suggests potential compromise. Investigate neighbors with high risk scores.
• Verify DNS Configuration: Ensure `proxy-ca013-san132.ahrefs.net` is legitimate and not misused for C2 or phishing.
• Firewall Rules:

- Block high-risk neighbors in 15.235.27.0/24.

- Restrict access to Ahrefs’ subnet if not required.

• Geo Validation: Investigate geo-plausibility discrepancies; consider spoofing or misconfigured routing.

---

Conclusion:

15.235.27.132 appears legitimate as part of Ahrefs’ CloudCompute infrastructure, but its subnet exhibits high abuse density. SOC teams should prioritize monitoring the subnet, validating DNS associations, and securing the network against potential lateral movement from compromised neighbors.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.