15.235.27.225📋 Copy

## IP INTELLIGENCE BRIEFING: 15.235.27.225/32

Executive Summary

Target IP 15.235.27.225 is hosted on OVH cloud infrastructure (ASN 16276) under organization "Dmytro, Ahrefs Pte Ltd" within CIDR block 15.235.27.0/24. Risk assessment indicates Moderate Risk (Score: 50) with high-abuse subnet classification. No active threat indicators present, but operational context warrants defensive consideration.

Technical Profile

• Risk Score: 50 (Moderate Risk)
• Ownership: OVH-CUST-281059692, Dmytro, Ahrefs Pte Ltd
• Geolocation: Canada (CA) per RIR records; conflicting Singapore location data
• Infrastructure Type: Cloud Compute / Hosting
• DNS Resolution: proxy-ca013-san225.ahrefs.net
• Services: No open ports detected; no TLS certificate; service banner absent
• Network Role: Firewalled / No Services

Neighborhood Analysis (15.235.27.0/24)

• Abuse Density: 0.6406 (High Abuse Classification)
• Subnet Risk: Inherited Risk Score: 25
• Sibling Activity: 256 total IPs; 211 active; 164 threat siblings
• Neighbor Risk Distribution: 100 medium-risk IPs (0 high, 0 low)
• Control Plane: BGP prefix 15.235.0.0/17; route stability flagged as unstable

Threat Assessment

• Threat Indicators: None detected (0 blacklists)
• Campaign Correlation: No known campaigns
• Historical Persistence: Not persistently malicious (threat observation count: 1)
• Geolocation Validity: Flagged as implausible (distance >3000km)
• Recent Activity: 17 observations recorded (most recent: 2026-06-15)

Operational Context

Relationship graph shows 33 connections, primarily to same network (OVH-CUST-281059692). The subnet exhibits elevated abuse density with significant threat sibling count relative to total active siblings (164/211 = 78% threat ratio among active neighbors).

Defensive Recommendations

Firewall blocking recommended across platforms:

• iptables: `iptables -A INPUT -s 15.235.27.225 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 15.235.27.225 drop`
• Cloudflare WAF: Block IP with filter expression `ip.src eq 15.235.27.225`
• AWS WAF: Address `15.235.27.225/32`

Note: Recommendations are probabilistic and should be combined with additional contextual signals before enforcement.

Intelligence Conclusion

This IP presents moderate risk within a high-abuse hosting environment. While no direct threat indicators exist, the subnet's abuse density and high threat sibling ratio suggest defensive caution. Consider blocking at perimeter if traffic patterns warrant, particularly given the hosting infrastructure context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.