15.235.96.84📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 15.235.96.84/32

Classification: Moderate Risk Infrastructure IP

Report Date: 2026-06-16

Prepared For: SOC Operations

---

## EXECUTIVE SUMMARY

IP 15.235.96.84 is a cloud infrastructure address hosted by OVH (ASN 16276) for Ahrefs Pte Ltd. The IP resolves to hostname proxy-ca015-san84.ahrefs.net and shows moderate risk (score 50) with evidence of blacklist presence. The associated /24 subnet (15.235.96.0/24) demonstrates high abuse density (0.6016) with 154 of 205 active sibling IPs flagged as threats. This IP is classified as "high_abuse" in its subnet and should be monitored for anomalous traffic patterns.

---

## INFRASTRUCTURE PROFILE

---

## THREAT INDICATORS

• Risk Score: 50 (Moderate)
• DNSBL Listings: 2 of 8 lists
• Abuse Confidence: Present with high-severity entries
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Associations: None identified

Historical Signals: 18 observations recorded. Recent activity (June 15-16, 2026) shows active blacklist listings with maximum severity rating "high". DNS and domain signals remain consistent with Ahrefs infrastructure.

---

## NEIGHBORHOOD ANALYSIS

The IP resides in subnet 15.235.96.0/24 with the following characteristics:

• Abuse Density: 0.6016 (High)
• Active Siblings: 205 of 256 total IPs
• Threat Siblings: 154
• Inherited Risk: 24

Risk Distribution in Subnet:

• High: 0
• Medium: 99
• Low: 1

The high concentration of medium-risk siblings suggests this is an abuse-prone hosting environment.

---

## NETWORK RELATIONSHIPS

• Network Association: OVH-CUST-281059694 (multiple duplicate links)
• DNS Associations: proxy-ca015-san84.ahrefs.net (17 records)
• Control Plane: BGP prefix 15.235.0.0/17, route stability: false
• RPKI State: Not verified
• DNSSEC: Valid

---

## SECURITY RECOMMENDATIONS

Immediate Actions

Based on the risk profile and abuse indicators, consider the following mitigation controls:

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 15.235.96.84 -j DROP

# nftables

nft add rule inet filter input ip saddr 15.235.96.84 drop

```

Web Application Firewall:

• Cloudflare WAF: Block with expression `ip.src eq 15.235.96.84`
• AWS WAF: Block CIDR 15.235.96.84/32 with description "IPDebrief risk 50"

Risk Assessment Notes

1. Contextual Consideration: IP is legitimately associated with Ahrefs (SEO analytics platform). Evaluate whether traffic patterns align with expected web traffic or exhibit suspicious behavior.

2. Subnet Context: The 15.235.96.0/24 subnet shows elevated abuse density. Consider evaluating entire /24 if legitimate traffic patterns cannot be verified.

3. Monitoring Priority: Medium-High. The combination of blacklist presence, high-risk subnet environment, and moderate individual risk score warrants monitoring.

---

## CONCLUSION

IP 15.235.96.84 represents legitimate Ahrefs infrastructure on OVH hosting with elevated threat indicators from its subnet environment. While not inherently malicious, the IP shows blacklist presence and operates in a high-abuse-density neighborhood. SOC teams should verify traffic patterns against baseline Ahrefs activity before applying blocking measures. Implement recommended firewall rules with appropriate logging for forensic analysis.

---

*This briefing is based on IPDebrief intelligence data. Recommendations should be evaluated in context of organizational risk tolerance and operational requirements.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.