15.235.98.162📋 Copy

# IP Intelligence Briefing: 15.235.98.162/32

Date: 2026-06-22

Classification: Moderate Risk / Hosting Infrastructure

Risk Score: 40/100

---

## Executive Summary

IP 15.235.98.162 is a cloud-based hosting infrastructure address associated with OVH SAS (ASN 16276) and registered to Dmytro, Ahrefs Pte Ltd. The IP exhibits moderate risk characteristics with a risk score of 40. While the IP itself shows no direct threat indicators, it resides within a high-abuse density subnet (15.235.98.0/24) with an abuse density of 0.6562 and 168 threat siblings out of 239 active neighbors.

---

## Ownership and Network Classification

Note: Geolocation data indicates Singapore (CA) but displays significant validation anomalies with RTT measurements inconsistent with claimed distance (27ms observed vs 121.6ms minimum possible for 6082km), suggesting potential geolocation spoofing or data inaccuracies.

---

## Network and Subnet Analysis

The 15.235.98.0/24 subnet demonstrates elevated abuse characteristics:

• Abuse Density: 0.6562 (high)
• Total Siblings: 256
• Active Siblings: 239
• Threat Siblings: 168
• Inherited Risk Score: 26

Neighboring IP risk distribution within the /24 subnet shows 100 medium-risk neighbors and zero high-risk or low-risk endpoints. Representative neighbors include 15.235.98.0 (risk 40), 15.235.98.1 (risk 50), and 15.235.98.2 (risk 50).

---

## DNS and Service Profile

• PTR Hostname: proxy-ca019-san162.ahrefs.net
• Forward Resolution: proxy-ca019-san162.ahrefs.net
• Domain Association: ahrefs.net
• Forward Resolution Count: 1
• Open Ports: None detected (firewalled/no services)
• HTTPS/TLS: No certificates detected
• Email Authentication: No SPF or DMARC records configured

The absence of open ports and services suggests this IP is either intentionally firewalled or represents a backend infrastructure endpoint without public-facing services.

---

## Threat and Control Plane Assessment

• Abuse Confidence Score: Not reported
• Blacklist Count: 0
• Known Tor Exit/Attacker/Spam Source: False
• DNSBL Listed: 1/8 total lists
• Operator Score: 0.2174 (Minimal)
• Route Stability: False
• BGP Prefix: 15.235.0.0/17
• Threat Persistence Days: 0

No active threat indicators were detected. The IP shows no correlation to known campaigns, attacker tooling, or malicious infrastructure markers.

---

## Historical Observations

The IP has been observed 23 times across multiple signal categories between June 17-22, 2026:

• June 22, 2026: Cloud infrastructure classification (confidence 0.90)
• June 18, 2026: High abuse subnet classification (confidence 0.75), operator score validation (confidence 0.60)
• June 17, 2026: Geolocation validation anomalies detected

The temporal profile indicates persistent presence without significant reputation degradation or escalation. No ownership changes recorded.

---

## Recommended Actions

Based on the moderate risk score (40) and subnet-level abuse context, the following actions are recommended:

Recommendation: Given the lack of direct threat indicators and the presence of services/firewalling, consider a block action with monitoring rather than immediate takedown. The subnet-level abuse density warrants blocking this IP to prevent potential lateral movement or abuse of the hosting infrastructure.

---

## Conclusion

IP 15.235.98.162 represents a moderate-risk hosting infrastructure endpoint with no direct malicious indicators but elevated neighborhood risk. The subnet classification as "high_abuse" with 168 threat siblings suggests defensive blocking is warranted. Continuous monitoring recommended for related IPs within the 15.235.98.0/24 block.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.