15.235.27.209📋 Copy

IP Intelligence Briefing: 15.235.27.209

*Last Updated: 2026-06-01*

---

**1. Risk Profile**

• Overall Risk Score: 50 (Moderate Risk)
• Ownership:

- ISP: OVH (ASN 16276)

- Organization: Dmytro, Ahrefs Pte Ltd

- Network: OVH-CUST-281059692

• Geolocation:

- Country: Canada (CA)

- City: Singapore (discrepancy noted; geo validation flagged as implausible)

- Coordinates: 56.13°N, -106.35°W (claimed, but RTT suggests Asia-Pacific origin)

- Distance from Probe: 6,082 km (RTT: 27ms, inconsistent with distance)

• Threat Indicators:

- No known malicious activity, spam, or campaigns.

- DNSBL Listings: 2/8 (moderate risk).

---

**2. Network & Infrastructure**

• Network Role:

- Cloud Hosting: Part of OVH's cloud infrastructure (OVH-CUST-281059692).

- Subnet: 15.235.27.209/24 (abuse density: 41.27%).

• Services:

- No open ports or TLS certificates detected.

- DNS PTR record: `proxy-ca013-san209.ahrefs.net` (linked to Ahrefs, an SEO tool).

• Control Plane:

- BGP Prefix: 15.235.0.0/17

- Route Stability: Unstable (route changes in last 30 days).

- DNSSEC Valid: Yes.

---

**3. Observation History**

• Recent Activity (Last 30 Days):

- Network Classification: Mixed (16 inherited risk points).

- Geo Validation: Flagged for implausible RTT (27ms) vs. 6,082 km distance.

- DNSBL Listings: 2/8 (moderate risk).

- Subnet Abuse Density: 41.27% (104/252 siblings flagged as threats).

---

**4. Relationships & Neighbors**

• Key Relationships:

- Same Network: OVH-CUST-281059692.

- DNS Associations: Multiple links to `proxy-ca013-san209.ahrefs.net`.

• Neighboring IPs (15.235.27.0/24):

- Total Siblings: 252

- Threat Siblings: 104 (42 medium risk, 58 low risk).

- Abuse Density: 41.27% (moderate risk).

---

**5. Recommendations**

• Monitoring:

- Track DNS traffic to `proxy-ca013-san209.ahrefs.net` for anomalies.

- Monitor RTT consistency for potential spoofing or data center activity.

• Mitigation:

- Consider rate limiting or blocking DNSBL-listed IPs in the subnet.

- Validate geolocation data for discrepancies (e.g., Singapore vs. Canada).

• Investigation:

- Cross-reference with Ahrefs' infrastructure to confirm legitimacy.

- Review subnet abuse patterns for potential collateral risk.

---

*Note: This IP is associated with a legitimate cloud hosting provider but exhibits geo-validation inconsistencies and moderate DNSBL risk. Further investigation into its DNS and network behavior is advised.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.