15.235.98.168📋 Copy

# IP INTELLIGENCE BRIEFING: 15.235.98.168/32

## Executive Summary

Target IP 15.235.98.168 is classified as MODERATE RISK (Score: 40/100) and operates within OVH cloud infrastructure. The IP resolves to Ahrefs.net domain infrastructure but exhibits high subnet abuse density (0.543) and inconsistent geolocation reporting. No active threat indicators detected.

## Ownership & Infrastructure

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 15.235.98.0/24
• Infrastructure Type: CloudCompute (OVH hosting)
• Network Classification: Firewalled / No Services Detected

## Geolocation Analysis

CONFLICTING GEOLOCATION DATA — Multiple data sources report inconsistent locations:

• Primary consensus: Singapore (CA region)
• Historical observations: Canada (CA), United States (US)
• Accuracy Radius: 3,000 km
• Geo-Plausibility: FALSE

This inconsistency warrants monitoring for potential reputation manipulation or infrastructure migration.

## DNS & Resolution

• PTR Hostname: proxy-ca019-san168.ahrefs.net
• Resolved Domain: ahrefs.net
• Forward Resolution: 1 record confirmed
• DNSSEC: Valid
• CAA Records: Present
• DNSBL Listings: 8 total lists (1 confirmed listing)

## Threat Indicators

• Known Attacker: FALSE
• Tor Exit Node: FALSE
• Spam Source: FALSE
• Campaign Associations: None detected
• Abuse Confidence Score: Not scored
• Threat Feeds: Clean

## Network Neighborhood Analysis

SUBNET: 15.235.98.0/24 — HIGH ABUSE DENSITY

• Abuse Density: 0.543 (Elevated)
• Active Siblings: 222/256
• Threat Siblings: 139 (62.6% of active IPs)
• Risk Distribution: 99 medium-risk, 1 low-risk, 0 high-risk

The subnet exhibits elevated abuse characteristics. This IP benefits from shared infrastructure reputation but should be evaluated within subnet context.

## Control Plane & Routing

• BGP Prefix: 15.235.0.0/17
• Route Stability: FALSE (Route changes detected in 30-day window)
• RPKI State: Not verified
• DNSSEC: Valid
• Operator Score: 0.2174 (Minimal)

## Temporal Observations

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 1
• Persistently Malicious: FALSE

## Historical Trends (Last 20 Observations)

Recent signal history indicates:

• Geolocation instability (CA/US/Singapore conflicts)
• Multiple threat feed associations detected on 2026-06-15
• Consistent network classification as high-abuse subnet
• Operator score remained stable at 0.2174

## Recommended Actions

1. MONITOR — No immediate blocking required; IP associated with legitimate Ahrefs infrastructure

2. SUBNET CONTEXT — Evaluate traffic patterns against subnet 15.235.98.0/24 abuse density

3. GEOLOCATION VALIDATION — Verify actual deployment location; inconsistent reporting may indicate infrastructure changes

4. DNSBL MONITORING — Track DNSBL listing status (8 total lists, 1 active)

## Intelligence Conclusion

Target IP represents cloud infrastructure for Ahrefs (SEO analytics platform) with no direct malicious indicators. However, the high-abuse subnet environment and geolocation inconsistencies warrant continued monitoring. No firewall rules recommended at this time; maintain traffic logs for behavioral analysis.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.