15.235.98.163📋 Copy

# IP INTELLIGENCE BRIEFING: 15.235.98.163/32

Classification: MODERATE RISK | Date Generated: 2026-06-19

---

## EXECUTIVE SUMMARY

IP 15.235.98.163 is a cloud-hosting infrastructure endpoint operated by OVH (ASN 16276) under customer account OVH-CUST-281059698. The IP resolves to hostname proxy-ca019-san163.ahrefs.net, indicating association with the ahrefs.net domain. While no active threat indicators are present on this specific address, the parent /24 subnet exhibits elevated abuse density (0.5391) with 138 threat-sibling IPs out of 220 active siblings.

---

## TECHNICAL PROFILE

Ownership & Provider:

• ASN: 16276 (OVH)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 15.235.98.0/24
• RIR: ARIN
• Infrastructure Type: CloudCompute
• Service Purpose: Firewalled / No Services

Geolocation:

• Country Code: CA (Canada)
• Reported City: Singapore
• RTT Anomaly: 28ms probe time inconsistent with 6,082km distance (minimum expected 121.6ms)
• GeoValidation: Flags indicate geolocation implausibility

DNS Configuration:

• PTR Hostname: proxy-ca019-san163.ahrefs.net
• Forward Resolution: proxy-ca019-san163.ahrefs.net (ahrefs.net)
• DNSSEC: Valid
• DNSBL Listed: 1 of 8 total lists

---

## RISK ASSESSMENT

Current Risk Score: 40/100 (Moderate)

Abuse Confidence Score: Not available

Blacklist Count: 0

Control Plane Indicators:

• Route Stability: False (route changes detected in 30-day window)
• RPKI State: Not available
• Operator Score: 0.2174 (Minimal)

Service Exposure:

• Open Ports: None detected
• TLS Certificate: None
• HTTP Services: None

---

## THREAT INDICATORS

Direct Threat Signals: None detected

• Not identified as Tor exit node
• Not flagged as known attacker
• Not classified as spam source
• No known campaign associations

Historical Observations: 19 signals recorded

• June 14-19, 2026: Consistent classification as OVH cloud hosting
• No escalation in threat posture observed
• Abuse density classification stable: high_abuse

---

## NEIGHBORHOOD ANALYSIS

Subnet: 15.235.98.0/24

• Abuse Density: 0.5391 (High)
• Total Siblings: 256
• Active Siblings: 220
• Threat Siblings: 138 (62.7% of active siblings)
• Risk Distribution: 0 High, 98 Medium, 2 Low

Inherited Risk: 21/100

Classification: High Abuse Subnet

---

## RELATIONSHIP GRAPH

Detected Relationships: 39

• Primary Association: Same Network (OVH-CUST-281059698)
• No external organization, hostname, or certificate relationships detected beyond OVH network infrastructure

---

## RECOMMENDED ACTIONS

Based on risk profile and neighborhood context, the following firewall rules are recommended:

Immediate Mitigation:

```bash

# iptables

iptables -A INPUT -s 15.235.98.163 -j DROP

# nftables

nft add rule inet filter input ip saddr 15.235.98.163 drop

# nginx

deny 15.235.98.163;

```

WAF Integration:

• Cloudflare WAF: Block (expression: ip.src eq 15.235.98.163)
• AWS WAF: Add rule for address 15.235.98.163/32

Contextual Notes:

• Blocking is recommended due to high-abuse neighborhood context
• Consider subnet-level blocking (15.235.98.0/24) if traffic volume permits
• Monitor for lateral movement within the /24 subnet given 62.7% threat sibling ratio

---

Disclaimer: These recommendations are probabilistic and should be combined with other signals before taking action.

Product: IPDebrief | Copyright: © 2026 Jason Alberino. All rights reserved.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.