15.235.96.118📋 Copy

# IP Intelligence Briefing: 15.235.96.118/32

## Executive Summary

IP 15.235.96.118 is a cloud compute endpoint operated by OVH (ASN 16276) under the organizational registration "Dmytro, Ahrefs Pte Ltd" within CIDR block 15.235.96.0/24. The address resolves to DNS hostname proxy-ca015-san118.ahrefs.net, indicating association with the ahrefs.net domain infrastructure. Current risk assessment rates the IP as Moderate Risk (40/100), though neighborhood analysis reveals this subnet exhibits high abuse density (0.7031) with 180 threat-sibling IPs out of 256 total addresses.

## Technical Profile

Ownership & Network:

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 15.235.96.0/24
• Infrastructure Type: Cloud Compute (OVH hosting)
• RIR: ARIN

Geolocation Analysis:

• Claimed Location: Singapore (CA)
• Geo Validation Status: Implausible
• RTT Anomaly: 27ms observed vs 121.6ms minimum possible for 6082km distance to Singapore
• Inferred Location: North America (based on RTT measurements)
• Distance Discrepancy: 6082km claimed vs actual

DNS & Services:

• PTR Hostname: proxy-ca015-san118.ahrefs.net
• Forward Resolution: proxy-ca015-san118.ahrefs.net
• Network State: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None

Threat Indicators:

• Blacklist Count: 1 (of 8 total DNSBL lists checked)
• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No
• Known Campaigns: None identified
• Abuse Confidence Score: Not populated

## Neighborhood Intelligence

The 15.235.96.0/24 subnet demonstrates elevated threat characteristics:

• Subnet Classification: High Abuse
• Abuse Density: 0.7031 (70.31%)
• Active Siblings: 218/256 addresses
• Threat Siblings: 180
• Inherited Risk Score: 28

Risk distribution across sampled neighbors indicates 100 medium-risk IPs with no high-risk siblings in the sample set. The subnet exhibits persistent hosting activity with minimal operational changes over time.

## Historical Signals

Analysis of 19 observations reveals consistent cloud hosting classification with OVH provider attribution. Recent observations (2026-06-20) maintain high confidence (0.85) for cloud compute designation. Control plane data shows origin ASN 16276 with BGP prefix 15.235.0.0/17. Route stability assessment indicates non-is route with zero route changes in the prior 30 days.

## Recommended Security Actions

Based on risk profile and neighborhood context, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 15.235.96.118 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 15.235.96.118 drop

```

nginx:

```

deny 15.235.96.118;

```

pfSense:

```

15.235.96.118/32

```

Cloudflare WAF:

```json

{

"description": "Block 15.235.96.118 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 15.235.96.118"

}

}

```

AWS WAF:

```json

{

"Addresses": ["15.235.96.118/32"],

"Description": "IPDebrief risk 40"

}

```

## Intelligence Assessment

The target IP represents a cloud compute endpoint within a high-abuse OVH hosting subnet. While the IP itself shows no direct threat indicators or active blacklist listings, the subnet-level abuse density warrants defensive caution. The geographic implausibility (Singapore claim with North America RTT) suggests potential misconfiguration or anonymization. The ahrefs.net DNS association indicates this IP may be part of a legitimate web infrastructure, but the high neighborhood abuse rate requires monitoring.

Recommended SOC Actions:

1. Monitor for emerging threat indicators

2. Block at perimeter based on neighborhood risk

3. Investigate any inbound traffic for legitimacy

4. Consider subnet-level blocking if threat correlation increases

---

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.