15.235.27.192📋 Copy

# IP Intelligence Briefing: 15.235.27.192/32

Classification: Moderate Risk | Risk Score: 40 | Generated: 2026-06-20

---

## Executive Summary

IP address 15.235.27.192 is a cloud-based hosting infrastructure node associated with Ahrefs Pty Ltd, deployed on OVH network (ASN 16276). The IP resolves to hostname proxy-ca013-san192.ahrefs.net and operates as a firewalled endpoint with no active services. While the endpoint itself shows no direct malicious indicators, it resides within a high-abuse density subnet (15.235.27.0/24) with 81% of active sibling IPs flagged as threats.

---

## Network Context & Infrastructure

Subnet Risk Profile: The /24 subnet carries high-abuse classification with abuse density of 0.707. Of 223 active sibling IPs, 181 are classified as threats.

---

## Threat Intelligence Findings

Direct Indicators:

• No threat indicators, blacklists, or known campaign associations
• Not identified as Tor exit node, known attacker, or spam source
• DNSBL listed on 1 of 8 total lists

Anomalies & Concerns:

• RTT geolocation validation failure: Claimed Canada location but 6082km distance with 26ms RTT violates minimum possible 121.6ms (5 probe measurements)
• Route instability: BGP prefix shows route changes in last 30 days
• Operator score: 0.2174 (Minimal)

---

## Historical Observations

18 observations recorded from 2026-06-20. Recent signals include:

• Subnet abuse density classification (high_abuse)
• RTT geolocation violations
• Operator score assessments

No persistent malicious behavior detected; IP classified as non-persistently malicious with zero threat persistence days.

---

## Recommended Security Actions

Defense Strategy: Block at network perimeter due to moderate risk score and high-abuse subnet context.

Firewall Rules:

• iptables: `iptables -A INPUT -s 15.235.27.192 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 15.235.27.192 drop`
• nginx: `deny 15.235.27.192;`
• pfSense: `15.235.27.192/32`
• Cloudflare WAF: Block with expression `ip.src eq 15.235.27.192`
• AWS WAF: Add address `15.235.27.192/32`

Note: These recommendations are probabilistic and should be combined with additional correlation signals before implementing.

---

## Analyst Notes

The IP presents a moderate-risk profile typical of cloud hosting infrastructure. While Ahrefs is a legitimate SEO tools provider, the high-abuse subnet context warrants defensive blocking. The geolocation discrepancies and route instability suggest potential infrastructure issues or rapid IP rotation practices. Monitor for any escalation in threat indicators or subnet-wide abuse patterns.

Confidence Level: Moderate | Recommended Action: Block

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.