15.235.96.251📋 Copy

IP Intelligence Briefing: 15.235.96.251

Date: 2026-06-10

---

**1. Core Profile**

• Risk Rating: Moderate (Risk Score: 40)
• Ownership:

- ISP: OVH (ASN 16276)

- Organization: Dmytro, Ahrefs Pte Ltd

- Network: OVH-CUST-281059694

• Geolocation:

- Country: Canada (CA)

- City: Singapore (discrepancy noted; geolocation may be spoofed or misconfigured)

- Accuracy Radius: 3,000 km

- RTT Anomaly: Observed RTT of 28ms vs. expected 121.6ms for 6,082km distance (potential spoofing or misconfigured routing).

• Network Role:

- Infrastructure: CloudCompute (OVH)

- Hosting: Yes (likely a residential or business server)

- Subnet: 15.235.96.0/24 (high abuse density: 0.502)

---

**2. Threat Indicators**

• No Direct Threats: No malware indicators, spam, or known attacker associations.
• Subnet Risk:

- Abuse Density: 50.2% (high risk subnet).

- Threat Neighbors: 128 malicious IPs in the same /24 subnet.

- Inherited Risk: 20 (moderate).

• DNS Associations:

- Hostname: `proxy-ca015-san251.ahrefs.net` (linked to Ahrefs).

- DNSSEC Valid: Yes.

- CAA Records: Present but no SPF/DKIM/DMARC configured.

---

**3. Observation History (Last 30 Days)**

• Geolocation: Consistent spoofed location (Singapore, CA).
• Network Activity:

- Subnet Stability: Unstable (route changes detected).

- BGP: No route leaks or anomalies.

• Services:

- No open ports, TLS, or HTTP services detected.

- No server banners or certificates.

---

**4. Neighborhood Analysis**

• Subnet: 15.235.96.0/24
• Neighbor Risk Distribution:

- High Risk: 0 IPs

- Medium Risk: 96 IPs

- Low Risk: 3 IPs

• Total Siblings: 255 IPs in subnet.
• Active Siblings: 165 (65% of subnet).
• Threat Siblings: 128 (49% of subnet).

---

**5. Recommendations**

1. Monitor Subnet: The 15.235.96.0/24 subnet has a high abuse density. Investigate potential compromise or misconfigured infrastructure.

2. Verify Geolocation: The IP’s geolocation (Singapore) conflicts with its registered location (Canada). Check for spoofing or routing anomalies.

3. DNS Security: Ensure Ahrefs’ DNS (proxy-ca015-san251.ahrefs.net) is configured with SPF/DKIM/DMARC to prevent misuse.

4. Network Segmentation: Segment cloud workloads to isolate potential compromised subnets.

5. Threat Hunting: Cross-reference with known campaigns or Ahrefs’ internal threat intelligence for contextual insights.

---

Source: IPDebrief Threat Intelligence Platform

Note: No direct malicious activity detected, but the subnet’s high abuse density warrants closer scrutiny.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.