15.235.27.180📋 Copy

# IP Intelligence Briefing: 15.235.27.180/32

## Executive Summary

IP 15.235.27.180 is a moderate-risk address (Risk Score: 50/100) hosted on OVH infrastructure under Ahrefs Pte Ltd ownership. The IP resolves to a proxy hostname on ares.net domain and operates within a high-abuse density subnet. No active threat indicators were observed, but the subnet context suggests elevated baseline risk.

## Profile Overview

• Risk Score: 50 (Moderate Risk)
• Provider: OVH (ASN 16276)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network: OVH-CUST-281059692
• CIDR Block: 15.235.27.0/24
• Geolocation: Reported Singapore (CA country code); geographically implausible with 6082km distance from expected location

## Network Classification

• Infrastructure Type: CloudCompute (Cloud Hosted)
• Connection Type: Hosting Provider
• Services: No active services detected (Firewalled / No Services)
• DNS PTR: proxy-ca013-san180.ahrefs.net
• Forward Resolution: Confirmed (ahrefs.net domain)
• TLS/HTTP: No certificates or HTTP services observed

## Threat Indicators

• Blacklist Count: 0
• Known Attacker: No
• Known Spam Source: No
• Tor Exit Node: No
• Active Threat Campaigns: None
• DNSBL Listed: 2 of 8 total lists

## Subnet Context (15.235.27.0/24)

• Classification: High Abuse
• Abuse Density: 0.5156 (51.56%)
• Total Siblings: 256
• Active Siblings: 227
• Threat Siblings: 132
• Inherited Risk Score: 20

The subnet demonstrates elevated abuse activity, with approximately 51% of addresses flagged as threats. This contextual risk should factor into security decisions despite the individual IP's moderate classification.

## Observation History

• Total Observations: 21 signals recorded
• Threat Persistence: 0 days (not persistently malicious)
• Recent Signals: Multiple geolocation and ownership signals with confidence scores ranging from 0.18 to 0.85
• Temporal Stability: No ownership changes detected; threat observation count: 1

## Recommended Security Actions

Immediate Blocking Rules

```bash

# iptables

iptables -A INPUT -s 15.235.27.180 -j DROP

# nftables

nft add rule inet filter input ip saddr 15.235.27.180 drop

# Nginx

deny 15.235.27.180;

# pfSense

15.235.27.180/32

# Cloudflare WAF

Expression: ip.src eq 15.235.27.180

Action: block

# AWS WAF

Addresses: 15.235.27.180/32

Description: IPDebrief risk 50

```

Analysis Notes

The IP resolves to Ahrefs infrastructure, a legitimate SEO analytics company. The moderate risk score combined with the high-abuse subnet classification suggests this address may be used for legitimate purposes but exists in a neighborhood with elevated malicious activity. Blocking is recommended based on risk score and subnet context, though verification of Ahrefs service legitimacy should be performed if legitimate operations are expected from this IP.

## Intelligence Assessment

This IP represents a moderate-risk asset on a high-density abuse subnet. The absence of active threat indicators and lack of blacklisting suggest the address itself is not directly malicious, but the subnet environment warrants defensive measures. Recommended action is to block at the perimeter while monitoring for any legitimate traffic patterns that may require whitelist exceptions.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.