15.235.96.168📋 Copy

# IP Intelligence Briefing: 15.235.96.168/32

## Executive Summary

IP 15.235.96.168 is a moderate-risk cloud infrastructure endpoint hosted on OVH network (ASN 16276), associated with Ahrefs domain infrastructure. The IP is firewalled with no open services but shows elevated neighborhood abuse density and recent blacklist activity. Recommended action: monitor but no immediate block required unless specific threat correlation exists.

---

## Network Profile & Ownership

• IP Address: 15.235.96.168/32
• Network: OVH-CUST-281059694
• CIDR Block: 15.235.96.0/24
• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Infrastructure Type: CloudCompute / Hosting
• Geolocation: Singapore (reported), CA (registration)
• Risk Score: 50 (Moderate Risk)
• Status: Firewalled / No Services

---

## Threat Assessment

Risk Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Abuse Confidence Score: Not calculated
• Blacklist Count: 0 (current profile)
• Control Plane: DNSBL listed on 2 of 8 total lists

Network Context

• Cloud Provider: OVH (hosting infrastructure)
• Connection Type: Firewall blocked
• Service Exposure: None detected

---

## Neighborhood Analysis (15.235.96.0/24)

The /24 subnet exhibits elevated abuse activity:

• Abuse Density: 0.5882 (high_abuse classification)
• Active Siblings: 199 out of 255 total IPs
• Threat Siblings: 150 IPs flagged as threats
• Inherited Risk Score: 23

The subnet shows significant abuse concentration. Neighboring IPs display risk scores ranging from 40-50, with 98 medium-risk and 2 low-risk neighbors sampled.

---

## DNS & Reputation Signals

• PTR Record: proxy-ca015-san168.ahrefs.net
• Resolving Domain: ahrefs.net
• Forward Resolution: Unconfirmed
• Email Authentication: No SPF or DMARC records
• CAA Records: Present (1 issuer)
• DNSSEC: Valid

---

## Observation History

The IP has 23 historical observations with notable patterns:

• Recent Activity: June 19, 2026 - Listed on 8 blacklist feeds with high severity
• Previous Activity: June 16, 2026 - Listed on 2 lists with high severity
• Signal Types: DNS resolution, operator scoring, comprehensive signal assessment
• Confidence Levels: 0.22 to 0.85 across observations

---

## Relationship Graph

The IP maintains multiple relationships to the "OVH-CUST-281059694" network identifier (50+ relationship entries). No direct connections to known malicious campaigns or external threat actors were identified.

---

## Recommended Actions

Immediate

• No firewall block required - IP is not actively malicious
• Monitor for C2 activity - Elevated neighborhood risk warrants observation

Mitigation Considerations

• Block outbound connections to this subnet if traffic patterns indicate abuse
• Monitor DNS queries to ahrefs.net subdomains for anomalies
• Review firewall logs for connection attempts from/to this IP

Contextual Notes

• The IP belongs to a hosting provider (OVH) with moderate abuse density
• Recent blacklist activity suggests intermittent reputation issues
• No evidence of persistent malicious behavior
• Consider subnet-level blocking if specific threat intelligence warrants

---

## Intelligence Quality Assessment

• Data Confidence: High (23 observations, multiple signal types)
• Coverage: Full profile, history, relationships, neighborhood data collected
• Actionability: Moderate - requires correlation with additional threat indicators

Classification: MODERATE RISK - MONITOR

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.