15.235.96.233📋 Copy

# IP Intelligence Briefing: 15.235.96.233/32

## Executive Summary

IP address 15.235.96.233 is a moderate-risk (Score: 40) cloud-hosted IP assigned to OVH SAS infrastructure, associated with domain ahrefs.net. While no direct malicious indicators are present, the IP operates within a high-abuse subnet (density: 0.6992) with 179 threat-sibling IPs. Recommended action: Block at perimeter, monitor for activity patterns.

---

## Network Profile

## Geolocation Assessment

• Country: Canada (CA) / Singapore (conflicting data)
• Accuracy: 3000km radius (low confidence)
• Note: Geographic signals show inconsistency; geolocation validation failed (geoPlausible: false)

## DNS Analysis

• PTR Record: proxy-ca015-san233.ahrefs.net
• Forward Resolution: proxy-ca015-san233.ahrefs.net
• Domain: ahrefs.net
• Forward Confirmed: No
• Email Security: No SPF/DMARC records present
• DNSSEC: Valid

## Threat Indicators

• Risk Score: 40 (Moderate Risk)
• Blacklist Count: 0
• DNSBL Listed: 1 of 8 lists
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Likelihood: None

## Neighborhood Analysis (15.235.96.0/24)

The subnet exhibits elevated abuse activity with 179 threat-identified neighbors. This IP should be monitored for lateral activity patterns.

## Control Plane Data

• Origin ASN: 16276
• BGP Prefix: 15.235.0.0/17
• Route Stability: Unstable
• Moas: No
• Operator Score: 0.2174 (Minimal)
• DNSSEC Valid: Yes
• Has CAA: Yes

## Observation History

19 observations recorded as of 2026-06-20. Recent signals include:

• ASN reputation flagged with threats (AlienVault OTX)
• DNS records resolving to ahrefs.net with CAA records present
• Subnet abuse density consistently high (0.6992)
• Operator score minimal (0.2174)

## Recommended Actions

Perimeter Blocking Rules

```bash

# iptables

iptables -A INPUT -s 15.235.96.233 -j DROP

# nftables

nft add rule inet filter input ip saddr 15.235.96.233 drop

# pfSense

15.235.96.233/32

# Cloudflare WAF

ip.src eq 15.235.96.233 → BLOCK

# AWS WAF

Addresses: 15.235.96.233/32

```

Operational Notes

• No open ports detected (firewalled configuration)
• Consider blocking subnet 15.235.96.0/24 if lateral threat activity observed
• Monitor for traffic to ahrefs.net domain from internal sources
• No immediate threat indicators; action recommended based on neighborhood risk profile

---

*Intelligence generated from IPDebrief analysis platform. Combine with other signals before implementing blocking rules.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.