15.235.98.131📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target IP: 15.235.98.131/32

Classification: MODERATE RISK – HOSTING INFRASTRUCTURE

Date: 2026-06-28

## EXECUTIVE SUMMARY

IP 15.235.98.131 is a firewalled hosting address assigned to OVH infrastructure (ASN 16276) under organization "Dmytro, Ahrefs Pte Ltd." The IP resolves to a DNS hostname under the ahrefs.net domain but exhibits no active services. The subnet demonstrates elevated abuse density (0.7188) with 184 of 256 active siblings flagged as threats.

## TECHNICAL PROFILE

Ownership & Classification

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network: OVH-CUST-281059698
• CIDR Block: 15.235.98.0/24
• Country: Canada (CA)

Network Services

• Status: Firewalled / No Services Detected
• Open Ports: None
• TLS Certificate: None
• HTTP Title: None

DNS Intelligence

• PTR Hostname: proxy-ca019-san131.ahrefs.net
• Forward Resolution: Confirmed (1 hostname)
• DNSBL Listed: 1 of 8 lists
• DNSSEC Valid: Yes
• CAA Records: Present

Risk Metrics

• Overall Risk Score: 40 (Moderate)
• Abuse Confidence: Not reported
• Threat Indicators: None detected
• Known Campaigns: None

## OBSERVATION HISTORY

Analysis of 21 historical observations reveals:

• Geolocation: Consistent Canada attribution (maxmind-geolite2-city, Cymru)
• Provider: Persistent OVH hosting classification since 2026-06-20
• Subnet Risk: High abuse density classification stable across observations
• Operator Score: 0.2174 (Minimal)
• Ownership Changes: 0 (stable assignment)
• Threat Persistence: 0 days (no persistent malicious activity observed)

## NEIGHBORHOOD ANALYSIS

Subnet 15.235.98.0/24 Assessment:

• Classification: High Abuse
• Abuse Density: 0.7188 (elevated)
• Total Siblings: 256
• Active Siblings: 246
• Threat Siblings: 184
• Inherited Risk: 28
• Risk Distribution: 100 medium-risk, 0 high-risk, 0 low-risk IPs sampled

Sample neighbor risk scores range from 40-50, indicating consistent moderate-risk classification across the subnet.

## RELATIONSHIPS

52 identified relationships, primarily:

• Same Network (OVH-CUST-281059698): 52 instances
• No external organization or certificate associations detected

## SECURITY ASSESSMENT

Threat Indicators: None detected

• No known attacker reputation
• No spam source classification
• No Tor exit node activity
• No active threat feeds matches
• No known campaign correlations

Risk Factors:

• High-abuse subnet environment (184 threat siblings)
• DNSBL listings (1 of 8)
• Hosting infrastructure with no visible services

## RECOMMENDED ACTIONS

For SOC Analysts:

1. Monitor but do not block: IP shows moderate risk (40) with no active threat indicators.

2. Subnet Context: Be aware of elevated abuse density in 15.235.98.0/24 subnet (184 threat siblings).

3. DNSBL Check: Verify against specific blacklist sources for 1 listed feed.

4. Traffic Analysis: Monitor for connection attempts to this hostname (proxy-ca019-san131.ahrefs.net) if ahist domain is relevant to your threat landscape.

Firewall Rules:

• No immediate blocking recommended based on current profile
• Consider subnet-level monitoring for 15.235.98.0/24 given high abuse density
• No actionable rules generated (IP is firewalled with no open services)

Classification: MONITOR – No immediate threat action required. Subnet-level awareness recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.