15.235.96.199📋 Copy

IP Intelligence Briefing: 15.235.96.199

Date: June 15, 2026

---

**1. IP Profile**

• Risk Score: 25 (Low Risk)
• Provider: OVH (ASN 16276)
• Ownership: Registered to Ahrefs Pte Ltd (OVH-CUST-281059694)
• Geolocation: Canada (QC), Beauharnois (approx. 3000km accuracy radius)
• Network Role: CloudCompute (OVH infrastructure)
• Services: No open ports, no TLS certificates, no HTTP services detected.
• Threat Indicators: No malicious activity, no abuse confidence scores, not listed in DNSBLs.

---

**2. Observation History**

• Recent Activity (June 15, 2026):

- Behavioral Anomaly: RTT (Round Trip Time) of 27ms detected, which is significantly lower than the minimum possible for the claimed geolocation (121.6ms). This suggests potential IP spoofing, proxy use, or misconfigured routing.

- Network Validation: Minimal risk score (0.2174) with no threat indicators.

- Consistency: No changes in ownership or threat signals over the past 30 days.

---

**3. Relationships**

• Network Associations:

- Linked to OVH-CUST-281059694 (same subnet).

- DNS association with proxy-ca015-san199.ahrefs.net (likely internal Ahrefs infrastructure).

• No Known Threat Links: No correlations to malicious campaigns, blacklists, or known attackers.

---

**4. Neighborhood Analysis**

• Subnet: 15.235.96.0/24
• Abuse Density: 47.24% (moderate risk).
• Neighbor Risks:

- 120 of 254 IPs in the subnet show threat activity.

- 165 IPs are active, with 120 flagged as risky.

• Context: While the IP itself is low risk, the subnet has a high abuse density, suggesting potential for lateral movement or shared infrastructure risks.

---

**5. Recommendations**

• Monitor RTT Anomalies: Investigate the unusually low RTT for 15.235.96.199. This could indicate proxy use, misrouting, or spoofing.
• Subnet Risk Mitigation: Consider isolating or segmenting the 15.235.96.0/24 subnet due to its moderate abuse density.
• DNS Verification: Confirm the legitimacy of the DNS association with `proxy-ca015-san199.ahrefs.net` to ensure no unauthorized use of Ahrefs infrastructure.
• Behavioral Baseline: Establish a baseline for the IP’s traffic patterns to detect deviations (e.g., unexpected outbound connections).

---

Note: This IP appears to be part of legitimate cloud infrastructure, but the subnet’s abuse density and RTT anomaly warrant further investigation to rule out covert operations or misconfigured networks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.