15.235.96.211📋 Copy

# IP INTELLIGENCE BRIEFING: 15.235.96.211/32

## EXECUTIVE SUMMARY

IP address 15.235.96.211 is classified as Moderate Risk (Risk Score: 40). The IP is hosted on OVH infrastructure (ASN 16276) under customer registration OVH-CUST-281059694. The address resolves to the Ahrefs domain (proxy-ca015-san211.ahrefs.net) but shows geographic inconsistency with RTT data indicating a 6,082 km distance from reported Singapore location.

---

## OWNERSHIP & INFRASTRUCTURE

---

## THREAT ASSESSMENT

Current Risk Score: 40 / 100

Threat Indicators:

• No known attack campaigns
• Not classified as Tor exit node, VPN, or proxy
• Zero blacklist listings
• No active threat indicators

Geolocation Anomaly:

• Reported country: Canada (CA)
• Detected RTT distance: 6,082 km (minimum possible: 121.6ms)
• Actual RTT: 28-32ms (indicates Asian location, likely Singapore)
• This discrepancy warrants attention for fraud detection

Control Plane:

• DNSSEC: Valid
• CAA: Present
• RPKI State: Not evaluated
• Route Stability: UNSTABLE (isRouteStable: false)
• DNSBL Listed: 1 of 8 total lists

---

## SUBNET ANALYSIS (15.235.96.0/24)

Abuse Classification: HIGH ABUSE

Neighbor Risk Distribution (sampled 100 IPs):

• High Risk: 0
• Medium Risk: 100
• Low Risk: 0

The /24 subnet exhibits elevated abuse density, with approximately 70% of addresses showing abuse indicators. This contextualizes the IP within a high-risk cloud hosting environment.

---

## NETWORK SERVICES

• Open Ports: None detected
• Service Status: Firewalled / No Services
• TLS Certificate: None
• HTTP Title: None
• Banner: None

The IP shows no active service signatures, consistent with a cloud hosting environment or dormant address.

---

## DNS RESOLUTION

• PTR Hostname: proxy-ca015-san211.ahrefs.net
• Forward Resolution: proxy-ca015-san211.ahrefs.net
• Domain: ahrefs.net
• Email Authentication: SPF/DMARC not configured
• Forward Resolution Count: 1

---

## OBSERVATION HISTORY

Total Observations: 19

Recent Activity: 2026-06-20

Key observations include:

• Subnet abuse density: 0.7031 (high_abuse classification)
• Provider classification: OVH hosting infrastructure
• Control plane operator score: 0.2174 (Minimal)
• No persistent malicious behavior detected

---

## RECOMMENDED ACTIONS

Based on the risk profile, the following blocking rules are recommended:

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 15.235.96.211 -j DROP

# nftables

nft add rule inet filter input ip saddr 15.235.96.211 drop

# nginx

deny 15.235.96.211;

# pfSense

15.235.96.211/32

# Cloudflare WAF

{"description":"Block 15.235.96.211 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 15.235.96.211"}}

# AWS WAF

{"Addresses":["15.235.96.211/32"],"Description":"IPDebrief risk 40"}

```

---

## INTELLIGENCE ASSESSMENT

This IP resides within a high-abuse-density cloud hosting subnet. While no direct attack indicators are present, the geographic inconsistency between reported and detected locations, combined with the subnet's abuse profile, warrants defensive blocking. The IP is not actively malicious but represents elevated contextual risk.

Recommended Action: BLOCK — Due to high abuse subnet classification and geographic verification failure

---

*Report generated from IPDebrief intelligence platform data. All findings are based on observed signals and should be corroborated with additional threat intelligence sources.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.