15.235.98.169📋 Copy

IP Intelligence Briefing: 15.235.98.169

Date: 2026-06-12

---

**1. Core Profile**

• Risk Score: 50 (Moderate Risk)
• Ownership:

- ISP: OVH (ASN 16276)

- Organization: Dmytro, Ahrefs Pte Ltd

- Subnet: 15.235.98.0/24

• Geolocation:

- Country: Canada (CA)

- City: Singapore (potential discrepancy; verify)

- Coordinates: 43.63°N, -79.37°E

• Network Role:

- Type: Cloud Compute (OVH infrastructure)

- Services: No open ports, no TLS certificates, no HTTP services detected.

- Hosting: Yes (likely a virtual machine or container).

---

**2. Threat Observations**

• Threat Indicators: None detected (no malware, phishing, or C2 activity).
• DNS Associations:

- Linked to `proxy-ca019-san169.ahrefs.net` (Ahrefs domain).

• Routing:

- BGP prefix: `15.235.0.0/17`

- Route stability: Unstable (route changes in 30 days).

• DNSSEC/CAA: Valid DNSSEC, CAA records present.

---

**3. Historical Trends**

• Signal Observations (Last 30 Days):

- Subnet abuse density: 39% (mixed classification).

- Inherited risk: 15 (low to moderate).

- No persistent malicious activity detected.

• Recent Changes:

- No significant shifts in risk profile.

---

**4. Network Relationships**

• Connected Entities:

- Subnets: 15.235.98.0/24 (OVH-owned).

- Domains: `ahrefs.net` (linked via DNS).

- Neighbors: 253 IPs in subnet; 99 flagged as threats.

---

**5. Subnet Analysis**

• Neighborhood Risk:

- Abuse Density: 39% (moderate).

- Active IPs: 180 (17 high-risk, 83 low-risk).

- Neighbors: Most IPs have low risk (score ≤ 25), but 17 are flagged.

• Notable IPs:

- `15.235.98.0/24` (OVH subnet with mixed risk).

---

**6. Recommendations**

• Monitoring:

- Track subnet for emerging threats (abuse density is moderate).

- Monitor `ahrefs.net` for DNS-related anomalies.

• Firewall:

- Consider blocking high-risk neighbors (e.g., IPs with ≥ 50 risk score).

• Verification:

- Investigate geolocation discrepancy (Canada vs. Singapore).

Conclusion: This IP is part of OVH’s cloud infrastructure, likely used by Ahrefs. While no direct threats are detected, the subnet has a moderate abuse density. SOC teams should monitor for lateral movement or subnet-wide compromises.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.