15.235.27.138📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target IP: 15.235.27.138/32

Date: 2026-06-16

Classification: Moderate Risk / Cloud Infrastructure

## EXECUTIVE SUMMARY

IP 15.235.27.138 is a cloud-based host associated with OVH hosting infrastructure (ASN 16276, organization: Dmytro, Ahrefs Pte Ltd) operating within the 15.235.27.0/24 subnet. The IP carries a moderate risk score of 40 and is associated with legitimate infrastructure (ahrefs.net), though the parent subnet exhibits elevated abuse density. No active threat indicators or malicious campaigns were observed.

## THREAT PROFILE

## NETWORK CONTEXT

The IP resides in a /24 subnet with significant abuse concentration:

• Abuse Density: 0.6602 (high_abuse classification)
• Active Siblings: 213 of 256 IPs
• Threat Siblings: 169 malicious IPs in the /24
• Inherited Risk: 26 from neighborhood context

The subnet 15.235.27.0/24 shows uniform risk distribution with 100 medium-risk neighbors, indicating OVH infrastructure hosting legitimate services alongside compromised hosts.

## OBSERVATION HISTORY

Analysis of 19 historical observations reveals:

• Recent Activity: Multiple signals observed on 2026-06-16
• Threat Persistence: 0 days (no persistent malicious behavior)
• Ownership Stability: 0 ownership changes
• Signal Types: Port scans, subnet abuse classification, threat list checks, network classification

The IP has not exhibited persistent malicious activity, with threat observation count at 1.

## RELATIONSHIP ANALYSIS

DNS relationships indicate association with ahrefs.net infrastructure:

• Primary Hostname: proxy-ca013-san138.ahrefs.net
• Network Association: OVH-CUST-281059692 (multiple relationship entries)

No certificate-based relationships or additional organizational links were identified.

## SECURITY ACTIONS

The following firewall rules are recommended for immediate implementation:

```bash

# iptables

iptables -A INPUT -s 15.235.27.138 -j DROP

# nftables

nft add rule inet filter input ip saddr 15.235.27.138 drop

# pfSense

15.235.27.138/32

# Cloudflare WAF

{

"description": "Block 15.235.27.138 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 15.235.27.138"

}

}

# AWS WAF

{

"Addresses": ["15.235.27.138/32"],

"Description": "IPDebrief risk 40"

}

```

## ANALYST NOTES

1. Geolocation Mismatch: Reported location (Singapore) shows 6,082km distance from expected location with RTT 26ms, which violates minimum possible RTT of 121.6ms for that distance. This suggests inaccurate geolocation data.

2. Subnet Context: Despite the individual IP's moderate risk score, the parent /24 subnet shows high abuse density. Consider blocking the entire 15.235.27.0/24 subnet if traffic patterns warrant it.

3. Legitimate Infrastructure: DNS association with ahrefs.net suggests the IP may be part of legitimate search engine optimization infrastructure. Verify business justification before implementing blocking rules.

4. No Active Threats: Zero open ports, no TLS certificates, and no HTTP services detected indicate the host is either properly firewalled or inactive.

5. Recommendation: Monitor subnet-wide activity. If the IP shows no outbound malicious activity after 24-48 hours of observation, consider white-listing the IP and blocking at the subnet level only if other IPs in the /24 demonstrate confirmed malicious behavior.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.