15.235.27.36📋 Copy

# IP Intelligence Briefing: 15.235.27.36

Date: 2026-06-16

Analyst: Automated Threat Intelligence System

Classification: Moderate Risk

## Executive Summary

IP 15.235.27.36 operates on OVH cloud infrastructure in Quebec, Canada with a moderate risk score of 40. The IP is associated with ares.net domain infrastructure and operates within a high-abuse density subnet (0.6406). Historical signals indicate proxy/VPN-type behavior with elevated risk indicators from third-party threat feeds.

## Threat Profile

Risk Assessment

• Risk Score: 40 (Moderate Risk)
• Provider Score: 0 (No provider-specific threat indicators)
• Authority Score: 0 (No authority-level indicators)
• Abuse Confidence: Insufficient data
• Threat Persistence: Not persistently malicious
• Threat Observation Count: 1

Network Classification

• Infrastructure Type: CloudCompute
• Hosting Provider: OVH SAS (AS16276)
• Network Block: 15.235.27.0/24
• Geographic Location: Beauharnois, Quebec, Canada
• Connection Type: Cloud-based hosting environment
• Services: Firewalled / No active services detected

DNS & Hostname Analysis

• Primary Hostname: proxy-ca013-san36.ahrefs.net
• Resolved Domain: ahrefs.net
• DNSSEC: Valid
• Forward Confirmation: Inconsistent (forward resolution not confirmed)
• PTR Records: proxy-ca013-san36.ahrefs.net

Threat Indicators

• DNSBL Listings: 1 of 8 total lists
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Blacklist Count: 0
• Campaign Matches: 0

## Neighborhood Analysis

The IP operates within subnet 15.235.27.0/24 showing elevated abuse characteristics:

Risk distribution across subnet neighbors:

• High Risk: 0
• Medium Risk: 46
• Low Risk: 54

## Historical Signal Analysis

18 observations collected with recent activity on 2026-06-16:

• Latest Routing Signal: Operator score 0.2174 (Minimal)
• ISP Classification: Proxy/VPN-type behavior identified
• Subnet Signal: Classified as high_abuse with 0.6406 density
• Third-Party Risk: proxycheck-io reports risk score of 66
• Ownership Stability: No ownership changes detected

## Network Relationships

• Network Relationships: 15+ associations to OVH-CUST-281059692
• DNS Associations: 15 hostname associations to proxy-ca013-san36.ahrefs.net
• Total Relationships: 29

## Recommended Security Actions

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 15.235.27.36 -j DROP

# nftables

nft add rule inet filter input ip saddr 15.235.27.36 drop

# nginx

deny 15.235.27.36;

# pfSense

15.235.27.36/32

# Cloudflare WAF

Action: Block

Expression: ip.src eq 15.235.27.36

# AWS WAF

Addresses: 15.235.27.36/32

Description: IPDebrief risk 40

```

Intelligence Notes

1. The subnet shows high abuse density (0.6406) with 164 identified threat siblings out of 211 active IPs

2. Third-party threat feeds classify this IP as proxy/VPN-type infrastructure

3. No active open ports or services detected on the IP

4. DNS associations point to ahrefs.net infrastructure (legitimate SEO tools company)

5. Consider blocking at perimeter if traffic patterns suggest abuse, as subnet-wide risk is elevated

Recommendation: Monitor inbound traffic from this IP for anomalous patterns. The moderate risk score (40) combined with high-abuse subnet context warrants defensive posture but does not indicate confirmed malicious activity.

---

*This intelligence briefing is generated from IPDebrief automated analysis. Validate findings with additional threat intelligence sources before implementing security controls.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.