15.235.96.157📋 Copy

# INTELLIGENCE BRIEFING: 15.235.96.157/32

Classification: MODERATE RISK | Timestamp: Current Intelligence Cycle | Report ID: IP-15.235.96.157-INTL

---

## EXECUTIVE SUMMARY

IP address 15.235.96.157 is a cloud-hosted proxy server belonging to Ahrefs Pte Ltd (OVH infrastructure). The IP exhibits moderate risk characteristics with no direct malicious indicators, though the associated /24 subnet demonstrates elevated abuse density. No active threat campaigns or known attacker associations detected.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH S.A.)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 15.235.96.0/24
• Infrastructure Type: Cloud Compute / Hosting
• Geolocation: Beauharnois, QC, Canada (CA)
• PTR Hostname: proxy-ca015-san157.ahrefs.net
• DNS Domain: ahrefs.net

The IP is configured as a firewalled cloud service with no active open ports or exposed services. DNS resolution confirms association with the legitimate Ahrefs domain.

---

## THREAT ASSESSMENT

Threat Indicators: No active threat indicators detected. No known campaigns or correlated malicious IPs observed.

---

## SUBNET ANALYSIS: 15.235.96.0/24

Classification: HIGH ABUSE DENSITY

• Abuse Density: 67.19%
• Total Siblings: 256
• Active Siblings: 213
• Threat Siblings: 172
• Inherited Risk Score: 26

Risk Distribution (Sampled Neighbors):

• High Risk: 0 (0%)
• Medium Risk: 98 (98%)
• Low Risk: 2 (2%)

The subnet exhibits elevated abuse density with significant concentration of medium-risk IPs. This contextual factor suggests the hosting provider maintains mixed-use infrastructure with legitimate services alongside potentially compromised endpoints.

---

## OBSERVATION HISTORY (23 Records)

Recent Observations:

• 2026-06-18: Confirmed not attacker, not Tor exit, no spam source, 0 blacklist entries
• 2026-06-17: Subnet classified as high abuse (0.6719 density), 172 threat siblings identified
• 2026-06-17: Operator score minimal (0.2174), DNSSEC valid

Temporal Stability:

• Ownership Changes: 0
• Threat Persistence: 0 days
• Persistently Malicious: No

The IP maintains stable ownership with no recent malicious activity transitions.

---

## RELATIONSHIP GRAPH

Detected Relationships: 49

• Network Associations: OVH-CUST-281059694 (primary)
• External Hostnames: None
• Associated Organizations: None beyond hosting provider
• Certificates: None

Relationships are limited to network-level associations with no external entity connections or certificate-based links.

---

## GEOLOCATION VALIDATION

• GeoPlausible: False
• Distance Discrepancy: 6082 km from probe location
• Minimum Possible RTT: 121.6ms vs. Observed 27.0ms
• Probe Count: 5

Note: Significant geolocation discrepancy detected. The reported location (Canada) shows RTT characteristics inconsistent with actual distance, suggesting potential location spoofing or probe routing anomalies.

---

## RECOMMENDED ACTIONS

For SOC/Defense Operations:

1. Monitor Subnet Context: While this specific IP shows no direct malicious activity, monitor the 15.235.96.0/24 subnet for elevated activity levels due to 67.19% abuse density.

2. Allow with Logging: Permissive stance recommended for this IP. No blocking indicators present, but maintain detailed logging for forensic purposes.

3. Geolocation Verification: Cross-reference connection times with reported geolocation. The 6082km discrepancy with 27ms RTT warrants investigation if used for access control decisions.

4. Ahrefs Association: Legitimate association with Ahrefs (SEO analytics platform). Confirm against organizational allowlists before applying restrictive controls.

Firewall Rule Recommendation:

```

# Allow with logging (no block required)

• A 15.235.96.157/32 log accept

```

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.