15.235.96.219📋 Copy

# INTELLIGENCE BRIEFING: 15.235.96.219/32

Classification: Moderate Risk | Date: Current | Status: Active Monitoring

## Executive Summary

IP address 15.235.96.219 is classified as Moderate Risk with a risk score of 40. The address is associated with OVH cloud infrastructure (ASN 16276) and resolves to a DNS hostname linked to Ahrefs Pte Ltd. Despite the moderate risk rating, the IP resides within a high-abuse subnet (15.235.96.0/24) showing 66.4% abuse density and 170 threat siblings among 256 total active IPs. No active threat indicators, known campaigns, or malicious reputation flags are currently detected.

## Technical Profile

## Neighborhood Analysis

The /24 subnet (15.235.96.0/24) demonstrates elevated risk characteristics:

• Abuse Density: 0.6641 (High Abuse Classification)
• Inherited Risk Score: 26
• Threat Siblings: 170 of 256 total IPs
• Risk Distribution: 99 medium-risk, 1 low-risk, 0 high-risk neighbors

This neighborhood context suggests the IP benefits from shared infrastructure characteristics common to OVH cloud hosting, though the high abuse density warrants defensive consideration.

## Historical Observations

Signal history from June 2026 indicates:

• DNS resolution consistently points to ahrefs.net with valid CAA records
• Subnet abuse classification persisted at high-level designation
• Operator score remains minimal (0.2174)
• No threat persistence observed (0 threat observation days)
• BGP routing shows instability (isRouteStable: false)

## Threat Indicators

• Blacklist Count: 0
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Known Campaigns: None
• Cert Matches: 0
• Correlated IPs: 0

## Recommended Actions

Based on the moderate risk profile and high-abuse neighborhood context, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 15.235.96.219 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 15.235.96.219 drop

```

nginx:

```

deny 15.235.96.219;

```

Cloudflare WAF:

```json

{"description":"Block 15.235.96.219 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 15.235.96.219"}}

```

AWS WAF:

```json

{"Addresses":["15.235.96.219/32"],"Description":"IPDebrief risk 40"}

```

pfSense:

```

15.235.96.219/32

```

## Analyst Notes

While the IP lacks direct malicious indicators, deployment of blocking rules is justified due to:

1. High-abuse subnet classification with 66% abuse density

2. 170 threat-identified siblings in immediate /24 neighborhood

3. OVH cloud infrastructure commonly abused for distributed campaigns

4. DNSBL listing on one of eight monitored lists

This IP should be monitored for any changes in threat posture or correlation with active campaigns. Consider blocking at the network perimeter level to prevent potential abuse vectors while maintaining log visibility for forensic analysis.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.