15.235.98.187📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 15.235.98.187/32

Classification: Hosting Infrastructure (OVH)

Risk Level: Moderate (Score: 40)

Jurisdiction: Canada (CA)

Generated: 2026-06-28

---

## Executive Summary

IP 15.235.98.187 is a moderate-risk (40) hosting infrastructure IP assigned to OVH (ASN 16276, organization: Dmytro, Ahrefs Pte Ltd). The address resolves to proxy-ca019-san187.ahrefs.net and hosts firewalled services with no open ports. While the IP shows no direct threat indicators, it resides within a high-abuse subnet (15.235.98.0/24) exhibiting 71.48% abuse density and 183 threat-sibling IPs.

---

## Technical Profile

---

## Neighborhood Analysis

Subnet: 15.235.98.0/24

Abuse Density: 0.7148 (High Abuse Classification)

Total Siblings: 256

Active Siblings: 242

Threat Siblings: 183

Inherited Risk: 28

The /24 subnet demonstrates elevated abuse activity with 71.48% of sibling IPs classified as abuse sources. This contextual risk factor warrants defensive consideration despite the target IP's clean direct indicators.

---

## Threat Observation History

• Total Observations: 26
• Threat Persistence: 0 days (not persistently malicious)
• Recent Activity: Cloud hosting classification confirmed (OVH)
• Campaign Correlation: None detected

Observations indicate stable cloud hosting assignment with consistent OVH provider attribution. No escalation in threat signals observed.

---

## Related Entities

• Domain: ahrefs.net (proxy endpoint)
• Network: OVH-CUST-281059698 (multiple relationship entries)
• BGP Prefix: 15.235.0.0/17
• Origin ASN: 16276
• RPKI State: Valid
• DNSSEC: Valid

---

## Defensive Actions

Based on risk profile and neighborhood context, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 15.235.98.187 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 15.235.98.187 drop

```

nginx:

```

deny 15.235.98.187;

```

Cloudflare WAF:

```json

{

"description": "Block 15.235.98.187 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 15.235.98.187"

}

}

```

AWS WAF:

```json

{

"Addresses": ["15.235.98.187/32"],

"Description": "IPDebrief risk 40"

}

```

---

## Intelligence Narrative

IP 15.235.98.187 presents moderate-risk hosting infrastructure with clean direct threat indicators. The IP serves as a proxy endpoint for ahrefs.net and is assigned to OVH's cloud hosting services. While the IP itself shows no evidence of malicious activity, the /24 subnet exhibits high abuse density (71.48%) with 183 threat-sibling addresses. This neighborhood context suggests defensive blocking is prudent for high-value targets.

Recommended Action: Implement blocking firewall rules for inbound traffic. Monitor for lateral movement indicators if this IP appears in traffic logs. No immediate threat to infrastructure detected; however, the subnet's abuse classification warrants ongoing monitoring.

---

*Intelligence produced by IPDebrief. All data derived from active network observations and threat intelligence feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.