15.235.27.34📋 Copy

# IP Intelligence Briefing: 15.235.27.34

Classification: Moderate Risk | Date: 2026-06-14 | Provider: OVH

## Executive Summary

IP 15.235.27.34 presents moderate risk (score: 40) from OVH cloud infrastructure. The IP resolves to a hosted domain (ahrefs.net) with no active services detected. Neighborhood analysis indicates high-abuse subnet classification with 149 threat siblings out of 185 active IPs. Geo-location data shows significant validation discrepancies.

## Network Ownership & Classification

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR: 15.235.27.0/24
• Network Role: CloudCompute / Hosting
• Infrastructure: OVH cloud provider

## Threat Indicators

• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False
• DNSBL Listed: 1 of 8 total lists

## Geolocation Analysis

• Reported Location: Singapore
• Country Code: CA
• Validation Status: Invalid
• Distance Violation: 6,082km claimed with 31ms RTT (minimum possible: 121.6ms)
• Geo Sources: 1 source with consensus

## DNS & Service Profile

• PTR Hostname: proxy-ca013-san34.ahrefs.net
• Forward Resolution: proxy-ca013-san34.ahrefs.net
• Domain: ahrefs.net
• Open Ports: None detected
• Status: Firewalled / No Services

## Neighborhood Assessment

• Abuse Density: 0.582 (High)
• Subnet Classification: high_abuse
• Total Siblings: 256
• Active Siblings: 185
• Threat Siblings: 149
• Risk Distribution: 100 medium-risk IPs, 0 high/low risk

## Historical Observations

21 observations recorded through 2026-06-14. Recent signals indicate:

• Consistent network classification as OVH hosting
• Persistent geolocation discrepancies
• Stable DNS resolution to ahrefs.net

## Recommended Security Actions

Immediate Firewall Rules

```bash

iptables -A INPUT -s 15.235.27.34 -j DROP

nft add rule inet filter input ip saddr 15.235.27.34 drop

nginx: deny 15.235.27.34;

pfSense: 15.235.27.34/32

```

Cloud Provider Rules

• Cloudflare WAF: Block with expression `ip.src eq 15.235.27.34`
• AWS WAF: Add address `15.235.27.34/32`

## Intelligence Assessment

Despite moderate risk classification, the IP exhibits concerning characteristics:

1. High-abuse subnet environment (58.2% abuse density)

2. Geographic validation failures suggest potential spoofing or misconfiguration

3. No active services but associated with hosting provider

4. 149 threat-sibling IPs in immediate neighborhood

Recommendation: Apply blocking rules while monitoring for lateral threat activity from sibling IPs. The high neighborhood abuse density warrants broader subnet-level consideration for defensive posture.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.