15.235.96.178📋 Copy

# Intelligence Briefing: IP 15.235.96.178/32

Classification: MODERATE RISK

Date: 2026-06-28

Analyst: IPDebrief SOC Team

Clearance: SOC Analysts

---

## Executive Summary

IP address 15.235.96.178 presents moderate risk (score: 40/100) and is associated with OVH cloud hosting infrastructure. The IP resolves to Ahrefs.net proxy infrastructure and is located within a subnet exhibiting high abuse density (67.19%). No active threat indicators or blacklist entries were observed, but the subnet's classification warrants defensive monitoring.

---

## Technical Profile

Network Identification:

• IP Address: 15.235.96.178/32
• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 15.235.96.0/24
• Network Name: OVH-CUST-281059694

Geolocation:

• Country: Singapore (CA)
• Accuracy Radius: 3,000 km
• GeoConsensus: False (multiple conflicting sources)
• Geolocation Plausibility: Not confirmed

Infrastructure Classification:

• Provider: OVH
• Infrastructure Type: Cloud Computing
• Hosting Provider: Yes
• CDN/Proxy/Tor: No
• Services: No open ports detected (firewalled)

---

## DNS Analysis

Reverse DNS (PTR):

• proxy-ca015-san178.ahrefs.net

Forward DNS:

• Forward resolution confirmed to proxy-ca015-san178.ahrefs.net
• Hosted domain count: 0

Email Authentication:

• SPF: Not configured
• DMARC: Not configured
• TXT Records: None detected

---

## Threat Intelligence

Risk Assessment:

• Overall Risk Score: 40/100 (Moderate)
• Abuse Confidence Score: Not applicable
• Blacklist Status: 0 blacklist entries
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

Control Plane Data:

• BGP Prefix: 15.235.0.0/17
• Route Stability: Not stable
• DNSSEC Valid: Yes
• DNSBL Listed: 1/8 total lists
• Operator Score: 0.2174 (Minimal)

---

## Neighborhood Analysis

Subnet Profile (15.235.96.0/24):

• Total Siblings: 256
• Active Siblings: 218
• Threat Siblings: 172
• Abuse Density: 0.6719 (High)
• Subnet Classification: High Abuse
• Inherited Risk Score: 26

Risk Distribution (100 neighbors analyzed):

• High Risk: 0
• Medium Risk: 100
• Low Risk: 0

The subnet exhibits concentrated medium-level risk activity across all analyzed neighbors.

---

## Historical Observation

Observation Count: 22 signals recorded

Recent Activity (June 2026):

• 2026-06-28: Multiple observations confirming cloud infrastructure classification
• 2026-06-20: Subnet abuse density recorded at 0.6719
• Ownership changes: 0
• Threat persistence days: 0
• Is persistently malicious: No

The IP shows consistent cloud hosting infrastructure classification with no observed malicious behavior escalation over the monitoring period.

---

## Relationships

Network Relationships:

• 53 recorded relationships, all pointing to same network identifier (OVH-CUST-281059694)
• No significant hostname, organization, or certificate relationships beyond network-level associations
• No correlated IPs from known campaigns detected

---

## Recommended Security Actions

Firewall Rules:

• iptables: `iptables -A INPUT -s 15.235.96.178 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 15.235.96.178 drop`
• nginx: `deny 15.235.96.178;`
• pfSense: `15.235.96.178/32`
• Cloudflare WAF: Block with expression `ip.src eq 15.235.96.178`
• AWS WAF: Block with CIDR `15.235.96.178/32`

Recommended Actions:

• Monitor for connection attempts from this subnet
• Block at perimeter if security policy permits
• No immediate escalation required based on current threat indicators

---

## Intelligence Assessment

This IP address is part of OVH cloud hosting infrastructure associated with Ahrefs.net. While no active malicious indicators were detected, the subnet's high abuse classification and concentrated medium-risk neighbor activity suggest potential for legitimate traffic to be mixed with abusive activity. The absence of blacklist entries and Tor/VPN indicators indicates this is not currently being used for known malicious purposes.

Threat Level: MODERATE

Action Required: Monitor/Block based on organizational policy

Last Updated: 2026-06-28

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.