15.235.96.16📋 Copy

# IP INTELLIGENCE BRIEFING: 15.235.96.16

Classification: MODERATE RISK | Report Date: 2026-06-20

Analyst: IPDebrief Intelligence Team

Purpose: SOC Threat Assessment and Incident Response Support

---

## 1. EXECUTIVE SUMMARY

IP 15.235.96.16 is assigned to OVH hosting infrastructure under organization "Dmytro, Ahrefs Pte Ltd" (ASN 16276). The IP presents a Moderate Risk profile with a risk score of 40. While the IP itself shows no direct threat indicators, it resides within a subnet (15.235.96.0/24) characterized by high abuse density (0.7031), with 180 of 256 total sibling IPs flagged as threats. The IP is classified as cloud infrastructure with hosting services, currently operating in a firewalled state with no open ports detected.

---

## 2. NETWORK CLASSIFICATION

Service Status: No open ports detected. HTTP/TLS services unavailable. Banner analysis: No identifiable server fingerprint.

---

## 3. GEOLOCATION ANALYSIS

Note: Geolocation data shows inconsistency between country code (CA) and city (Singapore), indicating potential routing or hosting infrastructure complexity. GeoPlausible validation: Failed.

---

## 4. THREAT INDICATORS

Campaign Assessment: No active campaigns detected. Likelihood: None. Correlated IPs: 0.

---

## 5. NEIGHBORHOOD RISK ASSESSMENT

Subnet: 15.235.96.0/24

Abuse Density: 0.7031 (High)

Classification: high_abuse

Inherited Risk Score: 28

Sibling IP Distribution:

• Total Siblings: 256
• Active Siblings: 218 (85.2% activity rate)
• Threat Siblings: 180 (70% threat ratio)
• Risk Distribution: 0 High, 90 Medium, 10 Low

Sample Neighbor Risk Scores:

• 15.235.96.0: Risk 40
• 15.235.96.1: Risk 50
• 15.235.96.2: Risk 40
• 15.235.96.3: Risk 40
• 15.235.96.4: Risk 40

Assessment: The subnet demonstrates elevated abuse activity. The target IP inherits a risk score of 28 from neighborhood context, suggesting correlated threat activity within the /24 block.

---

## 6. TEMPORAL BEHAVIOR

Observation History: 18 total observations

Most Recent: 2026-06-20

Threat Persistence Days: 0

Ownership Changes: 0

Is Persistently Malicious: No

Signal Timeline:

• Network classification signals: Active
• Geolocation signals: Inconsistent (CA/Singapore)
• Operator score: 0.2174 (Minimal)
• Control plane signals: Route stability: False

Assessment: No persistent malicious behavior detected. Ownership remains stable with no recent changes.

---

## 7. RELATIONSHIP GRAPH

Total Relationships: 47

Primary Associations:

• Multiple "Same Network" relationships to OVH-CUST-281059694
• No certificate or hostname relationships detected

Assessment: IP primarily associates with network infrastructure rather than external threat actors or compromised hostnames.

---

## 8. RECOMMENDED ACTIONS

Firewall/Block Rules:

• Recommended: Monitor with limited blocking due to moderate risk score (40) and no direct threat indicators
• Blocking Rationale: Consider blocking based on subnet-level abuse density if threat intelligence correlates with the /24 block

Action Items:

1. Monitor Traffic: Implement IDS/IPS monitoring for the /24 subnet given 70% threat sibling ratio

2. Review Connections: Investigate any inbound/outbound connections from/to this IP

3. Update Blocklists: Add to monitoring blocklists due to DNSBL presence (1/8 lists)

4. Subnet Assessment: Evaluate blocking or rate-limiting for 15.235.96.0/24 if organization policy permits

5. Geolocation Verification: Validate actual physical location for compliance logging

---

## 9. CONCLUSION

IP 15.235.96.16 operates as OVH cloud hosting infrastructure with moderate risk characteristics. While the IP itself shows no direct malicious indicators, the high-abuse density of its /24 subnet warrants monitoring and potentially enhanced filtering controls. No immediate blocking is required, but traffic should be logged and reviewed for suspicious patterns.

Priority: LOW-MEDIUM

Action Required: MONITOR

---

*Report generated by IPDebrief Intelligence Platform. All data sourced from live IP reputation and threat intelligence feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.