15.235.98.105📋 Copy

## INTELLIGENCE BRIEFING: IP 15.235.98.105/32

Classification: Moderate Risk | Threat Level: Elevated Due to Neighborhood Context

Executive Summary

IP 15.235.98.105 is a cloud-hosting infrastructure endpoint operated by OVH (ASN 16276) within the Ahrefs Pte Ltd organization. While the endpoint itself shows minimal direct threat indicators, it resides within a high-abuse density subnet (0.75), indicating elevated neighborhood risk.

---

Asset Profile

Geolocation & Routing

• Reported Location: Singapore (coordinates) / CA (country code)
• Validation Status: GEOLOCATION INCONSISTENT – RTT violation detected (27ms < 121.6ms minimum for reported distance)
• BGP Prefix: 15.235.0.0/17
• Route Stability: Unstable (isRouteStable: false)
• DNSSEC: Valid

DNS & Services

• PTR Record: proxy-ca019-san105.ahrefs.net
• Resolved Domain: ahrefs.net
• Open Ports: None
• HTTP Services: None
• TLS Certificates: None
• Email Auth: No SPF/DMARC records configured

Threat Indicators

Neighborhood Analysis (15.235.98.0/24)

• Abuse Density: 0.75 (HIGH)
• Classification: high_abuse
• Inherited Risk: 30
• Subnet Size: 256 IPs
• Active Siblings: 246
• Threat Siblings: 192
• Risk Distribution: 100 medium-risk neighbors, 0 high-risk neighbors

Relationship Graph

• Connected Entities: 45 relationships identified
• Primary Associations: OVH-CUST-281059698 network references
• Campaign Correlations: 0 matches

Observation History (20 Signals)

Recent signals indicate:

• Consistent cloud infrastructure classification from OVH
• No escalation in threat indicators over observation period
• Subnet abuse density consistently reported at 0.75
• No persistent malicious activity detected

---

Recommended Actions

Immediate:

1. Monitor inbound traffic from 15.235.98.0/24 – subnet shows high abuse density

2. Block if suspicious outbound connections observed from internal hosts

3. Alert on any connection attempts to ahrefs.net subdomains

Firewall Rules (Recommended):

```bash

# Block known high-abuse subnet

iptables -A INPUT -s 15.235.98.0/24 -j DROP

# Allow-list if legitimate traffic required

iptables -A INPUT -s 15.235.98.105 -p tcp --dport 443 -j ACCEPT

```

Monitoring Parameters:

• Track DNS queries to proxy-ca019-san105.ahrefs.net
• Monitor for unexpected service banners on this IP
• Watch for geolocation shifts (currently inconsistent)

---

Intelligence Narrative

This IP represents a cloud-hosting endpoint with moderate individual risk but elevated contextual risk due to neighborhood abuse patterns. The 0.75 abuse density across the /24 subnet suggests compromised or misconfigured co-located infrastructure. The geolocation inconsistency warrants further validation. No direct threat indicators are present, but the high-threat sibling count (192) indicates this subnet warrants defensive monitoring. Recommend implementing subnet-level filtering policies for this block until further investigation confirms legitimacy of traffic patterns.

Confidence Level: Medium – based on neighborhood context and infrastructure classification

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.