15.235.96.15📋 Copy

# IP INTELLIGENCE BRIEFING: 15.235.96.15/32

Classification: Moderate Risk | Date: 2026-06-26

Scope: Full Profile, History, Relationships, Neighborhood Analysis

---

## EXECUTIVE SUMMARY

IP 15.235.96.15 is a cloud-hosted infrastructure asset under OVH's cloud computing infrastructure (ASN 16276), registered to Dmytro, Ahrefs Pte Ltd. The IP resolves to a single PTR hostname (proxy-ca015-san15.ahrefs.net) and is currently firewalled with no active services. While the IP itself shows no direct threat indicators, the /24 subnet exhibits elevated abuse density (0.5352) with 137 threat siblings out of 256 total IPs. Geographic validation inconsistencies suggest data quality concerns requiring verification.

---

## ASSET PROFILE

---

## GEOLOCATION ANALYSIS

Note: Geographic data shows significant inconsistency. Reported Singapore location is geographically implausible for a Canadian IP assignment, with RTT measurements failing distance validation (30ms << 121.6ms minimum required for 6,082km).

---

## THREAT INDICATORS

Direct Threat Indicators: None observed. The IP does not appear in any known threat feeds or campaigns.

---

## NETWORK ROLE & CLASSIFICATION

Service Status: No open ports detected. Infrastructure is firewalled with no active services responding.

---

## DNS RESOLUTION

Note: Forward confirmation failed, indicating potential DNS issues or misconfiguration.

---

## SUBNET ANALYSIS (15.235.96.0/24)

| Threat Siblings | 1

---

## NEIGHBORHOOD ANALYSIS

Subnet: 15.235.96.0/24

Total Neighbors Analyzed: 100

Neighbor Risk Distribution: All analyzed neighbors show medium risk (Risk Score: 40, Authority Score: 50). No high-risk neighbors detected within immediate subnet proximity.

---

## TEMPORAL OBSERVATIONS

Total Observations: 19 signals recorded

Latest Observation: 2026-06-26T08:12:23.227689+00:00

Key Timeline Events:

• 08:12:23 – Subnet abuse density classification (High Abuse, 0.5352)
• 08:08:21 – Geolocation data inconsistency detected (CA/Singapore mismatch)
• 08:06:34 – Cloud infrastructure classification confirmed (OVH)
• 08:05:37 – Operator score assessment (Minimal, 0.1)

Threat Persistence: Not persistently malicious. No sustained threat campaign indicators observed.

---

## RELATIONSHIP MAPPING

Total Relationships: 53

Primary Relationship Type: Same Network (OVH-CUST-281059694)

All detected relationships map to the same customer network within OVH's infrastructure. No external threat actor associations or campaign-related connections identified.

---

## CONTROL PLANE ANALYSIS

---

## THREAT ASSESSMENT

---

## ACTIONS & RECOMMENDATIONS

SOC Analyst Actions:

1. Monitor – Track traffic patterns from subnet 15.235.96.0/24 given elevated abuse density

2. Verify – Confirm geographic data accuracy through secondary sources

3. Correlate – Review historical logs for any outbound connections from this IP

4. Block/Allow – No immediate blocking required; maintain visibility only

Risk Mitigation:

• No direct threat indicators require immediate remediation
• Monitor subnet-level activity for potential lateral movement indicators
• Update geolocation intelligence with verified data

---

Report Generated: 2026-06-26

Data Sources: IPDebrief Intelligence Platform

Confidence Level: Medium (Geographic validation inconsistencies present)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.