15.235.27.189📋 Copy

IP Intelligence Briefing: 15.235.27.189

*Generated via IPDebrief Analysis*

---

**Core Profile**

• Risk Assessment: Low Risk (Risk Score: 25)
• Ownership:

- ASN: 16276 (OVH)

- Organization: Ahrefs Pte Ltd (Hosting Provider)

- Subnet: 15.235.27.0/24

• Geolocation:

- Country: Canada (CA)

- City: Singapore (geo plausibility questionable)

- Coordinates: Lat 56.13, Lon -106.35 (approx 3000km accuracy)

• Network Role:

- Cloud Compute Instance (OVH Hosting)

- No open services or TLS certificates detected

---

**Threat Indicators**

• Malicious Activity: None detected (no threats, spam, or blacklists)
• DNS Associations:

- Resolves to `proxy-ca013-san189.ahrefs.net` (Ahrefs subdomain)

- No email authentication (SPF/DKIM) detected

• BGP & Routing:

- Route Stability: Unstable (route changes in last 30 days)

- RIPE NCC registration (ASN 16276)

---

**Observation History (Last 30 Days)**

• Key Signals:

- DNS geolocation inconsistencies (CA vs Singapore)

- Subnet abuse density: 43% (mixed classification)

- Minimal operator risk score (0.2174)

• Notable Events:

- No persistent malicious activity or campaign correlations

- DNSSEC valid, CAA records present

---

**Network Relationships**

• Connected Entities:

- Linked to OVH network `OVH-CUST-281059692`

- DNS association with Ahrefs subdomain

• Subnet Analysis:

- /24 subnet (15.235.27.0/24) with 252 total IPs

- 109 threat-scorched siblings (abuse density: 43%)

---

**Neighbor Risk Insights**

• Subnet Overview:

- 128 active IPs, 109 flagged as high/medium risk

- 41% low-risk IPs (including 15.235.27.189)

• Notable Neighbors:

- 15.235.27.0 (risk score 50)

- 15.235.27.1–4 (varied risk scores)

---

**Actionable Intelligence**

• SOC Recommendations:

- Monitor subnet for unusual traffic patterns (high abuse density).

- Validate DNS resolution for `proxy-ca013-san189.ahrefs.net` to confirm legitimacy.

- Ensure no unexpected outbound connections from the cloud instance.

• Firewall Rules:

- No immediate blocking required due to low-risk profile.

- Consider isolating high-risk neighbors in the subnet.

---

*Generated from IPDebrief analysis. Data reflects observed signals as of 2026-06-10.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.