15.235.27.72📋 Copy

# IP Intelligence Briefing: 15.235.27.72/32

Classification: Moderate Risk / Legitimate Cloud Infrastructure

Date: 2026-06-28

Analyst: IPDebrief Intelligence

---

## Executive Summary

IP 15.235.27.72 is assigned to OVH cloud infrastructure under Ahrefs Pte Ltd ownership. The IP carries a moderate risk score of 40 with no active threat indicators. However, the /24 neighborhood (15.235.27.0/24) exhibits elevated abuse density (0.707) with 181 threat-sibling IPs. Geovalidation anomalies indicate potential misreporting. No immediate blocking recommended; monitor for behavioral changes.

---

## Network Ownership & Infrastructure

• Organization: Ahrefs Pte Ltd (SEO analytics platform)
• ASN: 16276 (OVH SAS)
• CIDR Block: 15.235.27.0/24
• Infrastructure Type: CloudCompute (OVH hosting)
• Registration: ARIN, RIR-registered

The IP is part of a cloud compute subnet used by Ahrefs for proxy services, as evidenced by DNS PTR record `proxy-ca013-san72.ahrefs.net`.

---

## Risk Assessment

Threat Indicators: None detected. IP is not flagged as Tor exit node, known attacker, or spam source.

---

## Geolocation Analysis

• Reported Location: Beauharnois, Quebec, Canada
• Distance Validation: ❌ VIOLATION DETECTED

- Claimed distance: 6,082 km

- Observed RTT: 22ms

- Minimum possible RTT: 121.6ms

- Conclusion: Reported geolocation implausible; IP likely not physically located in Canada

---

## Neighborhood Analysis

Subnet: 15.235.27.0/24

Risk Distribution:

• High Risk: 0 IPs
• Medium Risk: 78 IPs
• Low Risk: 22 IPs

The subnet shows elevated abuse density consistent with cloud hosting environments. Multiple IPs in the range (15.235.27.0-4) show risk scores between 25-50.

---

## Network Services & DNS

• Open Ports: None detected (firewalled)
• HTTP Services: None detected
• DNS Records:

- PTR: `proxy-ca013-san72.ahrefs.net`

- Forward Resolution: Confirmed

- CAA Records: Present

- DNSSEC: Valid

No active services detected; IP appears to be a static cloud address without open ports.

---

## Historical Signals (23 Observations)

• DNS Resolution: Consistent ahrefs.net domain resolution
• Subnet Classification: Maintained high_abuse classification (0.707 abuse density) across observations
• Geolocation: Persistent implausibility violations in RTT validation
• Threat Status: No escalation to persistent malicious behavior

---

## Recommended Actions

Firewall Policy:

• Allow with monitoring (no immediate block)
• Consider rate limiting if outbound traffic anomalies detected
• Monitor for C2 communication patterns

Threat Intel Integration:

• Add to watchlist if suspicious outbound connections observed
• Correlate with known Ahrefs infrastructure campaigns

Investigation Priority:

• MEDIUM (monitor subnet behavior)
• No immediate incident response required

---

## Conclusion

15.235.27.72 is a legitimate cloud infrastructure address owned by Ahrefs. The moderate risk score reflects neighborhood abuse density rather than direct malicious activity. Geovalidation anomalies warrant awareness but do not indicate active threat. SOC analysts should monitor for behavioral changes but may treat as low-priority infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.