15.235.96.209

{ } JSON 🔧 Full Actions API

🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

## INTELLIGENCE BRIEFING: 15.235.96.209/32

Classification: Moderate Risk | Priority: Monitor | Last Updated: 2026-06-19

---

EXECUTIVE SUMMARY

IP address 15.235.96.209 is a cloud compute host operating within an OVH infrastructure block with documented high-abuse characteristics. While no active threat indicators are present on this specific host, the subnet exhibits elevated abuse density requiring situational awareness.

---

OWNERSHIP & INFRASTRUCTURE

Organization: Dmytro, Ahrefs Pte Ltd
ASN: 16276 (OVH SAS)
Network: OVH-CUST-281059694
CIDR Block: 15.235.96.0/24
Infrastructure Type: Cloud Compute
Hosting Status: Active
PTR Hostname: proxy-ca015-san209.ahrefs.net
Associated Domain: ahrefs.net (legitimate SEO analytics platform)

---

GEOSPATIAL ANALYSIS

Discrepancy Detected:

Reported Location: Singapore (City), CA (Country Code)
RTT Analysis: 6,082km distance reported with 27ms RTT
Anomaly: RTT value (27ms) violates minimum possible latency for 6,082km distance (minimum 121.6ms)

Assessment: Geolocation data is unreliable. The RTT violation suggests either CDN/proxy involvement or data integrity issues. Forward DNS resolution confirms ahrefs.net domain association.

---

THREAT INDICATORS

Indicator	Status
Blacklist Count	0
Tor Exit Node	No
Known Attacker	No
Spam Source	No
DNSBL Listed	1 of 8 lists
Open Ports	None
Active Services	None (Firewalled)

Threat Observation Count: 1 | Persistence Status: Non-persistent

---

NEIGHBORHOOD RISK ASSESSMENT

Subnet: 15.235.96.0/24

Abuse Density: 64.84% (HIGH)
Classification: High Abuse
Total Siblings: 256
Active Siblings: 215
Threat Siblings: 166
Inherited Risk Score: 25

Assessment: The /24 subnet demonstrates significant abuse prevalence. 166 out of 256 IPs (64.8%) exhibit threat activity, suggesting potential shared infrastructure or compromised network segments.

---

OBSERVATION HISTORY

Total Observations: 19 signals
Most Recent: 2026-06-19T21:40:40 UTC
Signal Types: Ownership changes, subnet abuse metrics, threat list checks, operator scores, dimensional analysis
Threat Persistence: 0 days
Ownership Changes: 0

---

RELATIONSHIP GRAPH

Total Relationships: 49
Primary Association: OVH-CUST-281059694 (Same Network)
Secondary Associations: Limited to network-level relationships

---

SECURITY ACTIONS & RECOMMENDATIONS

Recommended Actions: None (automatically generated by risk profile)

Manual Assessment:

1. Monitor, Do Not Block: No active threat indicators present on this IP

2. Subnet Awareness: Monitor for activity patterns originating from 15.235.96.0/24 due to high abuse density

3. DNS Validation: Forward DNS resolves to ahrefs.net—verify if this aligns with organizational usage

4. Geolocation Corroboration: Investigate source of geolocation discrepancy; may indicate proxy/CDN usage

---

RISK ASSESSMENT MATRIX

Factor	Rating	Weight
Individual Risk Score	40	Moderate
Subnet Abuse Density	High	Elevated
Threat Indicators	None	Low
Infrastructure Type	Cloud	Variable
Geolocation Validity	Poor	Monitor

OVERALL RISK: MODERATE | RECOMMENDATION: Monitor traffic patterns; investigate subnet-level abuse correlation

---

*Report generated from IPDebrief intelligence platform data.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

Country	🇨🇦 Canada
Region	—
City	Singapore
Timezone	—
Latitude	43.63
Longitude	-79.37

🏢 Ownership & Registration

Organization	Dmytro, Ahrefs Pte Ltd
ASN	AS16276
Network Name	OVH-CUST-281059694
CIDR Block	15.235.96.0/24
RIR	ARIN
Country	Singapore
Abuse Contact	—

🌐 DNS Intelligence

PTR	proxy-ca015-san209.ahrefs.net
Forward Confirmed	No — PTR hostname does not resolve back to this IP (weak signal)
Forward Hostnames	`proxy-ca015-san209.ahrefs.net`

🔐 DNS Hygiene

Hygiene Score	40% (Fair)
SPF	Not configured
DMARC	Not configured
FCrDNS	Not verified
DNSSEC	Valid
CAA	Present

☁️ Network Classification

Infrastructure	Infrastructure / Datacenter
Service Purpose	Firewalled / No Services
Network Tier	Hosting — Infrastructure provider without advanced routing

CloudHosting

🔌 Services & Open Ports

Port	Service	Protocol	Banner
No open ports detected

Server	—
HTTP Title	—

🔐 TLS Certificate

🔒

No certificate

Issued by —

N/A

SANs	None
Valid From	—
Valid Until	—

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

Dimension	Score	Sources	Observations
threat	33%	2	3
routing	13%	1	1
services	8%	1	1
ownership	19%	2	2
reputation	31%	1	3
geolocation	33%	2	3
Overall	23%	9	13

Coverage: 6/6 dimensions · Data sufficiency: sufficient

Data Coherence	Mixed Signals (60%) — 2 contradiction(s)
Attribution	Very Low (20%)
	OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

⚠ Claimed geolocation contradicts RTT physics measurement
⚠ Geo sources disagree on country: US, CA

📅 Observation Timeline 🔄 Live

First Seen	2026-05-13 19:03:53 UTC
Last Seen	2026-06-27 23:41:26 UTC
Profile Built	2026-06-28 17:47:23 UTC
Data Freshness	Live
Signal Types	19
Total Observations	22

🔍 19 signal types · 22 observations collected

This report is generated from 19+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.

{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.

15.235.96.209📋 Copy