15.235.96.93📋 Copy

# IP INTELLIGENCE BRIEFING

Subject: 15.235.96.93/32

Date: 2026-06-16

Classification: Moderate Risk

---

## EXECUTIVE SUMMARY

IP 15.235.96.93 is a cloud-hosted address belonging to OVH's infrastructure (ASN 16276), assigned to organization "Dmytro, Ahrefs Pte Ltd." The IP presents a moderate risk profile with a risk score of 50/100. The address is associated with the ahrefs.net domain and is hosted on cloud infrastructure with active firewall configuration.

---

## INFRASTRUCTURE PROFILE

---

## THREAT INDICATORS

Blacklist Status:

• DNSBL Listings: 2 active listings across 8 total blacklist sources
• Abuse Confidence: Not scored
• Campaign Association: None detected

Control Plane Indicators:

• Route stability: Unstable (isRouteStable: false)
• Operator score: 0.2174 (Minimal)
• DNSSEC: Valid
• RPKI: Not assessed

Geolocation Discrepancy:

• Reported country: CA (Canada)
• Reported city: Singapore
• Validation Issue: RTT measurement indicates 30ms average for ~6082km distance, violating minimum possible RTT of 121.6ms for this distance. Location data requires validation.

---

## NEIGHBORHOOD ANALYSIS

Subnet Risk Profile (15.235.96.0/24):

• Abuse Density: 0.5938 (High abuse classification)
• Total IPs: 256
• Active IPs: 205
• Threat IPs: 152 (59% of active)
• Inherited Risk: 23/100

Risk Distribution (sample of 100 neighbors):

• High Risk: 0%
• Medium Risk: 98%
• Low Risk: 2%

Assessment: The /24 subnet exhibits elevated abuse density with over half the active IP addresses classified as threats. This indicates systemic compromise or misconfiguration within this cloud hosting block.

---

## OBSERVATION HISTORY

Recent Activity (20 observations):

• 2026-06-16: DNS resolution confirmed to ahrefs.net with CAA records present
• 2026-06-15: Confirmed cloud hosting infrastructure (OVH)
• 2026-06-15: Subnet abuse density flagged as high_abuse
• Threat Persistence: 0 days (not persistently malicious)

Temporal Analysis: No significant threat persistence observed. Ownership changes: 0. Threat observation count: 1.

---

## NETWORK RELATIONSHIPS

Connected Entities (37 relationships):

• Primary Network: OVH-CUST-281059694 (multiple relationship records)
• Type: Same Network (all relationships)
• Assessment: Well-documented within OVH infrastructure ecosystem

---

## RECOMMENDED ACTIONS

Firewall Rules:

```

# Block high-risk subnet activity

iptables -A INPUT -s 15.235.96.0/24 -j DROP

```

Monitoring Priority:

• Priority: Medium
• Rationale: Moderate risk score with high-abuse subnet context
• Action: Monitor for outbound connections to this subnet

Additional Considerations:

• Validate geolocation data due to significant discrepancy
• Review DNSBL listings for specific blacklist sources
• Monitor subnet 15.235.96.0/24 for additional compromise indicators

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.