15.235.96.35📋 Copy

# IP Intelligence Briefing: 15.235.96.35/32

Date: 2026-06-17

Classification: Moderate Risk / High-Abuse Neighborhood

Source: IPDebrief Threat Intelligence Platform

---

## Executive Summary

IP 15.235.96.35 is a cloud hosting endpoint operated by OVH (ASN 16276) under the organization Dmytro, Ahrefs Pte Ltd. The IP presents a moderate risk profile (score: 40) but operates within a high-abuse density subnet (abuse density: 0.6719). The endpoint is associated with the ahrefs.net domain infrastructure and is currently firewalled with no active services.

---

## Network & Ownership Profile

---

## Threat Indicators

• Threat Classification: Moderate Risk
• Known Campaigns: None identified
• Known Attacker Status: False
• Spam Source: False
• Tor Exit Node: False
• Blacklist Count: 0
• DNSBL Listings: 1 of 8 lists
• Operator Score: 0.2174 (Minimal)

---

## Neighborhood Analysis (15.235.96.0/24)

The subnet exhibits significant abuse activity with 67% abuse density. The target IP is surrounded by 172 known threat-sibling endpoints, indicating this is a shared cloud infrastructure block with elevated malicious activity.

---

## DNS & Infrastructure

---

## Geolocation

*Note: Geographic discrepancy detected between reported CA and plausible Singapore location. 3000km accuracy radius indicates geolocation uncertainty.*

---

## Temporal Analysis & History

• Observation Count: 21 signals over observation period
• Recent Classification: Consistent "high_abuse" subnet classification
• Threat Persistence: 0 days
• Ownership Changes: 0
• Recent Signals (June 13-17, 2026):

- Subnet abuse density maintained at 0.6719

- Operator score stable at 0.2174

- Geographic signals show CA reporting with 35% confidence

---

## Relationship Graph

• Total Relationships: 43
• Primary Association: OVH-CUST-281059694 (Network)
• Network Consistency: Multiple "Same Network" relationships to OVH customer subnet
• No Certificate or Hostname Correlations Identified

---

## Security Recommendations

1. Allow/Block Decision: Given moderate risk score (40) and association with legitimate ahrefs.net infrastructure, default action should be ALLOW unless specific malicious activity is observed.

2. Neighborhood Context: Monitor traffic patterns due to high-abuse density (0.6719) in parent subnet. 172 threat siblings indicate elevated risk environment.

3. Traffic Analysis: Apply behavioral analysis for outbound connections from this subnet. Cloud hosting environments in this block show mixed legitimate and malicious use.

4. DNS Policy: Monitor for DNS queries to proxy-ca015-san35.ahrefs.net for potential credential harvesting or proxy abuse.

5. GeoValidation: Investigate geographic reporting discrepancies between CA and Singapore data for potential spoofing or data center misreporting.

---

Analyst Notes: This endpoint represents legitimate cloud infrastructure with moderate risk. However, the high-abuse neighborhood context warrants ongoing monitoring. No immediate blocking recommended without additional threat intelligence correlation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.