15.235.27.211📋 Copy

IP INTELLIGENCE BRIEFING: 15.235.27.211/32

Classification: MODERATE RISK | Cloud Infrastructure Host

---

EXECUTIVE SUMMARY

IP address 15.235.27.211 is hosted on OVH cloud infrastructure (ASN 16276) under account OVH-CUST-281059692. The IP resolves to hostname proxy-ca013-san211.ahrefs.net, indicating association with Ahrefs services. The subnet exhibits elevated abuse activity with 62.89% abuse density and 161 confirmed threat siblings among 193 active IPs.

---

RISK ASSESSMENT

---

INFRASTRUCTURE PROFILE

• Provider: OVH SAS (CloudCompute)
• Organization: Dmytro, Ahrefs Pte Ltd
• Country: Singapore (geo confidence 0.35)
• Infrastructure Type: Cloud Hosting
• Service Status: Firewalled / No Services Detected
• Open Ports: None
• TLS Certificate: Not Present

---

DOMAIN RESOLUTION

• PTR Hostname: proxy-ca013-san211.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed (1 record)
• Email Authentication: No SPF/DMARC records configured

---

THREAT INDICATORS

• Active Threat Indicators: None
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Association: None

---

NETWORK CONTEXT

The /24 subnet (15.235.27.0/24) shows:

• Total Siblings: 256
• Active Siblings: 193
• Threat Siblings: 161 (63.7% of active)
• Risk Distribution: 100 medium-risk neighbors
• Inherited Risk Score: 25

---

OBSERVATION HISTORY

• Total Observations: 19
• Recent Subnet Classification: High Abuse (0.6289 density)
• DNSBL Activity: 2026-06-09 — Listed on 1 blacklist with high severity
• Ownership Stability: No changes detected
• Threat Persistence: Single observation (0 days persistent)

---

RECOMMENDED ACTIONS

Immediate:

• Monitor for outbound connections from this subnet
• Apply rate limiting to proxy-ca013-san211.ahrefs.net connections
• Block traffic from any subnet siblings flagged as threats

Firewall Rules:

```

# Block high-risk subnet neighbors (example)

iptables -A INPUT -s 15.235.27.0/24 -j DROP

# Or allowlist specific if legitimate traffic required

iptables -A INPUT -s 15.235.27.211 -j ACCEPT

```

Monitoring:

• Track DNS query patterns for ahrefs.net subdomains
• Monitor for port scanning activity from subnet
• Alert on new blacklist additions for this IP

---

ASSESSMENT: The IP operates legitimate Ahrefs infrastructure but resides in a high-abuse cloud subnet. SOC teams should monitor subnet-level activity while allowing the specific IP if legitimate business traffic is required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.