15.235.96.136📋 Copy

# THREAT INTELLIGENCE BRIEFING: 15.235.96.136/32

Date: 2026-06-28

Risk Level: Moderate Risk (Score: 40/100)

Classification: Cloud Hosting Infrastructure

## Executive Summary

IP 15.235.96.136 is a cloud hosting IP address operated by OVH (ASN 16276) on behalf of Ahrefs Pte Ltd. The address resolved to a hostname proxy-ca015-san136.ahrefs.net and is associated with the domain ahrefs.net. No active threat indicators or known campaigns were observed. The IP exhibits moderate risk characteristics consistent with commercial cloud hosting environments.

## Technical Profile

• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 15.235.96.0/24 (OVH-CUST-281059694)
• Infrastructure Type: CloudCompute (OVH provider)
• Geolocation: Canada (QC, Beauharnois)
• DNS: Forward resolution confirmed to proxy-ca015-san136.ahrefs.net
• Services: No open ports detected; firewall or no services exposed

## Risk Assessment

The IP received a risk score of 40/100, classified as Moderate Risk. Control plane analysis indicated DNSBL listing on 1 of 8 threat lists. No evidence of Tor exit node, VPN, proxy, or known attacker behavior. No active threat indicators, blacklist hits beyond DNSBL, or campaign associations were identified.

## Neighborhood Context

The /24 subnet (15.235.96.0/24) exhibits high abuse density at 0.7031 (70.31%), with 180 of 256 total siblings flagged as threats. All sampled neighbors showed medium risk classification (score: 40). This pattern indicates a shared cloud hosting environment where legitimate infrastructure coexists with potentially compromised hosts.

## Observation History

Twenty-two signal observations recorded since 2026-06-20. Recent signals consistently show cloud infrastructure classification with OVH provider. No ownership changes or persistent malicious behavior detected. Threat persistence days: 0.

## Geolocation Validation

RTT-based validation discrepancy noted: Reported location (Canada) showed minimum possible RTT of 121.6ms for 6082km distance, while observed RTT was 27.0ms. This suggests routing anomalies or geolocation data inconsistency rather than confirmed malicious activity.

## Recommended Actions

No immediate blocking recommended. The IP represents legitimate cloud hosting infrastructure with moderate risk. SOC teams should:

• Monitor for anomalous traffic patterns inconsistent with hosting operations
• Evaluate context of any observed connections against known Ahrefs service profiles
• Consider subnet-level monitoring for broader abuse trends in the 15.235.96.0/24 block

## Conclusion

15.235.96.136 is a legitimate OVH cloud hosting IP associated with Ahrefs. No actionable threat intelligence indicates malicious activity. Standard monitoring and contextual analysis advised.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.