15.235.27.44📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 15.235.27.44/32 | Classification: Moderate Risk (Score: 40) | Date: 2026-06-17

---

## EXECUTIVE SUMMARY

IP 15.235.27.44 is a cloud infrastructure address registered to Ahrefs Pte Ltd via OVH (ASN 16276). The IP presents moderate risk due to high-abuse subnet context and geolocation anomalies, with no confirmed active threat campaigns. Recommended action: Monitor inbound traffic; no immediate blocking required.

---

## OWNERSHIP & INFRASTRUCTURE

DNS Resolution: proxy-ca013-san44.ahrefs.net (ahrefs.net)

• SPF/DMARC: Not configured
• DNSSEC: Valid
• Certificate Authority Records: Present

---

## GEOLOCATION ANALYSIS

Assessment: Geolocation data is inconsistent. The 27ms RTT contradicts the claimed 6082km distance, indicating potential spoofing or routing anomaly.

---

## THREAT INDICATORS

• Risk Score: 40 (Moderate)
• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Listed: 1 of 8 lists

Control Plane:

• BGP Prefix: 15.235.0.0/17
• Route Stability: Unstable
• Route Changes (30d): 0
• RPKI State: Not reported

---

## NEIGHBORHOOD CONTEXT

Subnet: 15.235.27.0/24

• Abuse Density: 0.6953 (High Abuse)
• Total Siblings: 256
• Active Siblings: 217
• Threat Siblings: 178
• Inherited Risk: 27

Risk Distribution: All sampled neighbors (100) show medium-risk scores (40-50).

---

## NETWORK SERVICES

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Server Banner: None
• Classification: Firewalled / No Services

---

## OBSERVATION HISTORY

Total Signals: 23 observations

Recent Activity:

• Subnet abuse density: 0.6953 (high_abuse)
• Operator score: 0.2174 (minimal)
• Ownership changes: 0
• Threat persistence days: 0

Signal Confidence Range: 0.24 - 0.85

---

## RELATIONSHIPS

Total Relationships: 45

• Primary: Same Network (OVH-CUST-281059692)
• No external organization or certificate relationships identified

---

## SECURITY ACTIONS RECOMMENDED

For SOC Analysts:

1. Monitor traffic from 15.235.27.0/24 subnet due to high abuse density

2. Review inbound connections for anomalous patterns given geolocation inconsistency

3. Track DNS queries to ahrefs.net for potential C2 indicators

Firewall Rules (Example):

```bash

# Block subnet-wide if required (monitor first)

iptables -A INPUT -s 15.235.27.0/24 -j DROP

```

Risk Mitigation:

• No immediate blocking required
• Enable logging for traffic from this subnet
• Monitor for changes in geolocation consistency

---

## CONCLUSION

IP 15.235.27.44 is a legitimate cloud host with no active threat indicators. The primary concern is the high-abuse subnet context and geolocation anomalies. Maintain monitoring posture but no immediate containment actions recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.