15.235.96.20📋 Copy

# IP Intelligence Briefing: 15.235.96.20/32

Classification: Moderate Risk / High Abuse Subnet

Date: Analysis completed per available data

---

## Executive Summary

IP address 15.235.96.20 is associated with Ahrefs Pte Ltd infrastructure hosted on OVH Cloud. The IP exhibits moderate risk (score: 40) with elevated subnet-level threat activity. Listed on 8 DNSBLs including high-severity entries. No active services detected (firewalled/no services).

---

## Risk Profile

## Infrastructure Details

• Hosting Provider: OVH (Cloud Compute infrastructure)
• Network Role: CloudCompute / Hosting
• DNS PTR Hostname: proxy-ca015-san20.ahrefs.net
• Associated Domain: ahrefs.net
• Service Status: No open ports detected (Firewalled / No Services)
• Email Authentication: No SPF or DMARC records

## Threat Indicators

• DNSBL Listings: 8 total lists (1 flagged as high severity)
• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

## Geolocation Assessment

• Reported Location: Singapore
• Country Code: CA (Canada)
• Confidence: Low (accuracy radius: 3000km)
• Note: Significant geolocation inconsistency detected between reported city (Singapore) and country code (CA). Validation recommended.

## Subnet Analysis (15.235.96.0/24)

The subnet exhibits elevated abuse activity with 137 of 221 active IP addresses showing threat indicators. Risk distribution among neighbors shows medium-level risk across the subnet.

## Observation History

• Total Observations: 19
• Recent Activity: Multiple DNSBL listings observed as of June 26, 2026
• Operator Score: Minimal (0.1)
• Threat Persistence: Single observation period
• Ownership Stability: No ownership changes recorded

## Network Relationships

• Total Relationships: 53
• Primary Association: Same Network (OVH-CUST-281059694)
• Classification: All relationships point to same OVH customer network

---

## Intelligence Assessment

The IP 15.235.96.20 belongs to Ahrefs corporate infrastructure but operates within a high-abuse subnet environment. The combination of:

1. High subnet abuse density (0.5352)

2. Multiple DNSBL listings (8 total, 1 high severity)

3. Geolocation inconsistencies

4. Lack of service exposure (firewalled)

Suggests this IP may be part of a larger infrastructure where legitimate and potentially malicious endpoints coexist. The subnet's 61% threat ratio (137/221 active siblings) indicates elevated risk context.

## Recommended Actions

1. Monitor for outbound connections from this IP to known malicious destinations

2. Validate geolocation data through independent sources

3. Review associated DNSBL listings for severity and recency

4. Consider subnet-level threat correlation for similar 15.235.96.x addresses

5. Block if specific threat indicators emerge; current risk level warrants monitoring rather than immediate blocking

---

Report Generated: IPDebrief Intelligence Platform

Status: Active Monitoring Recommended

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.