15.235.96.229📋 Copy

# INTELLIGENCE BRIEFING: IP Address 15.235.96.229/32

Classification: Moderate Risk | Report Date: 2026-06-21

## EXECUTIVE SUMMARY

IP address 15.235.96.229 is a cloud-based infrastructure address hosted by OVH, associated with Ahrefs Pte Ltd. The address carries a moderate risk score of 40. While no direct malicious indicators were observed, the address resides within a high-abuse subnet (15.235.96.0/24) with an abuse density of 0.707, indicating systemic infrastructure compromise or misconfiguration within the customer block.

## OWNERSHIP AND INFRASTRUCTURE

• ASN: 16276
• Organization: Dmytro, Ahrefs Pte Ltd
• Netname: OVH-CUST-281059694
• Infrastructure Type: Cloud Compute / Hosting
• Registration RIR: ARIN
• DNS Resolution: proxy-ca015-san229.ahrefs.net
• Service Status: Firewalled / No Services Detected

## GEOLOCATION ANALYSIS

• Reported Country: CA (Canada)
• Reported City: Singapore
• Geolocation Confidence: Low (geoPlausible: false)
• RTT Validation: VIOLATION DETECTED

- Observed: 25ms

- Minimum Possible for 6082km distance: 121.6ms

- This discrepancy indicates geolocation data is unreliable

## THREAT ASSESSMENT

Current Risk Profile

• Overall Risk Score: 40 (Moderate)
• Abuse Confidence Score: Not available
• Blacklist Status: 0 direct blacklists
• DNSBL Listings: 1 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Subnet Analysis (15.235.96.0/24)

• Abuse Density: 0.707 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 220
• Threat Siblings: 181
• Risk Distribution: High (0%), Medium (79%), Low (21%)

The high abuse density (0.707) and 81% of active siblings classified as medium-risk indicates this /24 block is experiencing widespread abuse. The IP's risk is partially inherited from neighborhood context (inherited risk: 28).

## OBSERVATION HISTORY

• Total Observations: 19 signals
• Most Recent Activity: 2026-06-21T05:08:58 UTC
• Threat Persistence Days: 0
• Ownership Changes: 0
• Is Persistently Malicious: No

Key historical signals:

• Cloud infrastructure classification confirmed (OVH hosting)
• No attacker/attacker-tool/Spam source indicators
• Network role identified as provider/cloud compute

## NETWORK RELATIONSHIPS

• Primary Network: OVH-CUST-281059694
• Relationship Count: 38
• Primary Association: Ahrefs.net domain (DNS PTR)

## SECURITY RECOMMENDATIONS

Based on the moderate risk score (40) and high-abuse subnet context, the following controls are recommended:

Immediate Actions

1. Block at Perimeter: The IP should be blocked at firewall boundaries due to moderate risk combined with high-abuse neighborhood context.

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 15.235.96.229 -j DROP

# nftables

nft add rule inet filter input ip saddr 15.235.96.229 drop

# Cloudflare WAF

{

"description": "Block 15.235.96.229 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 15.235.96.229"

}

}

# AWS WAF

{

"Addresses": ["15.235.96.229/32"],

"Description": "IPDebrief risk 40"

}

```

Contextual Considerations

• The subnet (15.235.96.0/24) shows 181 out of 220 active IPs flagged as threats. Consider evaluating whether to block the entire /24 prefix if organizational risk tolerance permits.
• Geolocation data is unreliable (RTT violations). Do not use for geolocation-based policies.
• No services detected on this IP; it may be a passive host or firewall-protected.

## CONCLUSION

IP 15.235.96.229 is not currently generating direct threat indicators but resides within a significantly compromised OVH hosting block. The moderate risk score (40) combined with the high-abuse subnet context (0.707 abuse density) justifies blocking at organizational boundaries. The geolocation discrepancy (claimed Canada vs. Singapore with RTT violations) indicates unreliable location data. Continued monitoring of the 15.235.96.0/24 block is recommended given the 81% threat sibling rate.

---

*This briefing is based on IPDebrief intelligence data as of 2026-06-21. Recommendations should be validated against internal threat context before implementation.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.