15.235.27.198📋 Copy

# IP Intelligence Briefing: 15.235.27.198/32

## Executive Summary

IP 15.235.27.198 is a moderate-risk (score: 40) cloud infrastructure address hosted on OVH network infrastructure under the organization Dmytro, Ahrefs Pte Ltd (ASN 16276). The IP resolves to the ahrefs.net domain with hostname proxy-ca013-san198.ahrefs.net. The address operates in a high-abuse subnet (15.235.27.0/24) with an abuse density of 0.668, where 171 of 256 sibling IPs are flagged as threats.

## Profile Assessment

• Risk Classification: Moderate Risk (40/100)
• Network Provider: OVH (CloudCompute infrastructure)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 15.235.27.0/24
• Geolocation: Reported as CA (Canada), but geolocation data is inconsistent with Singapore coordinates. RTT validation flagged a violation—measured 27ms vs. minimum possible 121.6ms for reported distance of 6,082km.
• Network Role: Cloud hosting with no open services detected. Firewall/No Services classification.

## DNS and Hostname Analysis

• PTR Record: proxy-ca013-san198.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Unconfirmed
• Email Authentication: No SPF or DMARC records detected
• DNSBL Status: Listed on 1 of 8 DNSBLs

## Threat Indicators

• Abuse Confidence Score: Not available
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0 (despite DNSBL listing)
• Known Campaigns: None correlated
• Cert Matches: 0
• Campaign Likelihood: None

## Observation History

The IP has 22 recorded observations. Recent signals (2026-06-20) indicate:

• Ownership classification as OVH cloud infrastructure with confidence 0.85
• Domain resolution to ahrefs.net with confidence 0.80
• Geolocation signals showing Canadian country code with low confidence (0.18)
• Control plane operator score of 0.2174 (labeled "Minimal")
• Single threat observation recorded
• Not persistently malicious

## Neighborhood Analysis (15.235.27.0/24)

• Total Subnet IPs: 256
• Active Siblings: 220
• Threat-Classified Siblings: 171
• Risk Distribution: 0 high-risk, 83 medium-risk, 17 low-risk
• Abuse Density: 0.668 (high)
• Inherited Risk: 26

## Security Recommendations

Based on the moderate risk classification and high-abuse neighborhood context:

1. Monitor Closely: The subnet exhibits elevated abuse density. Implement enhanced monitoring on traffic from 15.235.27.0/24.

2. Rate Limiting: Apply rate limiting rules for connections from this IP due to cloud hosting nature and firewall status.

3. Geolocation Validation: The conflicting geolocation data (Canada vs. Singapore coordinates with RTT mismatch) warrants validation before allowing untrusted access.

4. DNSBL Review: Investigate the 1 DNSBL listing to determine specific reasons for inclusion.

5. Email Authentication: The absence of SPF and DMARC records for ahrefs.net may indicate misconfiguration or potential abuse vectors.

## Intelligence Confidence

• Profile Confidence: Moderate (riskScore 40, multiple data sources)
• Geolocation Confidence: Low (RTT violation indicates data inconsistency)
• Threat Confidence: Low (no active threat indicators, but neighborhood context suggests caution)

---

*Report generated by IPDebrief intelligence platform. All data sourced from real-time IP intelligence collection.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.