15.235.96.187📋 Copy

# INTELLIGENCE BRIEFING: 15.235.96.187/32

## EXECUTIVE SUMMARY

IP address 15.235.96.187 is a moderate-risk (score: 40) cloud infrastructure endpoint associated with OVH hosting provider under the organization Dmytro, Ahrefs Pte Ltd. The IP is hosted within the 15.235.96.0/24 subnet, which exhibits high abuse density (64%), with 164 of 256 sibling IPs flagged as threat-related. The endpoint is firewalled with no open services detected, and geolocation data indicates Singapore placement with RTT validation anomalies.

## INFRASTRUCTURE PROFILE

• Provider: OVH (ASN: 16276)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Block: 15.235.96.0/24
• Infrastructure Type: CloudCompute / Hosting
• Connection Type: Firewalled / No Services
• PTR Hostname: proxy-ca015-san187.ahrefs.net
• Forward Resolution: proxy-ca015-san187.ahrefs.net (1 hostname)
• DNS Classification: Cloud provider with Ahrefs.net domain association

## RISK ASSESSMENT

• Overall Risk Score: 40 (Moderate)
• Abuse Confidence Score: Not applicable (no active abuse indicators)
• Blacklist Status: Listed on 1 of 8 DNSBL lists
• Threat Indicators: None identified
• Campaign Associations: No known campaign matches
• Known Attacker Status: False
• Tor Exit Node: False
• Spam Source: False

## GEOLOCATION INTELLIGENCE

• Reported Location: Singapore, Singapore (CA)
• Geolocation Confidence: Low (geoPlausible: false)
• Accuracy Radius: 3000 km
• RTT Analysis: Anomaly detected — measured 28ms against 121.6ms minimum possible for 6082km distance, indicating potential geolocation spoofing or routing manipulation
• Probe Count: 5 successful probes

## NETWORK NEIGHBORHOOD ANALYSIS

The 15.235.96.0/24 subnet presents elevated risk characteristics:

• Abuse Density: 0.6406 (64% of IPs flagged as threats)
• Active Siblings: 205 out of 256 total
• Threat Siblings: 164 IPs classified as threats
• Inherited Risk Score: 25
• Risk Distribution in Subnet: High: 0, Medium: 99, Low: 1

This indicates the subnet is heavily utilized for potentially suspicious activity, requiring defensive posture awareness.

## OBSERVATION HISTORY

Analysis of 25 historical observations reveals:

• Latest Observation: 2026-06-20T15:00:23Z
• Signal Types Observed: Geolocation (country: CA), Operator score (Minimal), Network classification (Cloud/Hosting), Port scan (no open ports)
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0 (stable ownership)

Recent scans confirm the endpoint remains firewalled with no accessible services.

## RELATIONSHIP MAPPING

The IP maintains 36 relationships, predominantly network-level associations pointing to OVH-CUST-281059694. No external organization, certificate, or hostname relationships detected beyond the OVH provider network.

## THREAT INTELLIGENCE NARRATIVE

IP 15.235.96.187 represents a moderate-risk cloud infrastructure asset within an OVH-managed subnet exhibiting high abuse density. While no active threat indicators are present against this specific address, the surrounding 15.235.96.0/24 subnet demonstrates concerning abuse patterns with 64% of sibling IPs flagged as threats. The endpoint's association with ahrefs.net (a known SEO/marketing analytics platform) suggests legitimate use, yet the DNSBL listing and subnet-level abuse density warrant monitoring.

## RECOMMENDED ACTIONS

1. Monitoring: Add to watchlist due to subnet abuse density

2. Firewall Rules: Apply block rules for any malicious activity originating from this subnet

3. DNSBL Verification: Investigate the single DNSBL listing for context

4. Traffic Analysis: Monitor for anomalous traffic patterns from this IP

5. Subnet Context: Consider broader policy decisions for the 15.235.96.0/24 block given the 164 threat siblings

## CLASSIFICATION

• Risk Level: Moderate
• Action Priority: Monitor
• Threat Type: Infrastructure hosting / CloudCompute
• Attribution: Dmytro, Ahrefs Pte Ltd (OVH)

---

*Intelligence generated by IPDebrief Threat Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.