15.235.98.235📋 Copy

## THREAT INTELLIGENCE BRIEFING

Target: 15.235.98.235/32

Classification: Moderate Risk / Cloud Infrastructure

EXECUTIVE SUMMARY:

The IP address 15.235.98.235 belongs to OVH cloud infrastructure (ASN 16276, organization "Dmytro, Ahrefs Pte Ltd") and presents a moderate risk profile with a risk score of 40. The address operates within a high-abuse-density subnet (15.235.98.0/24) with an abuse density of 0.5391. Geovalidation anomalies and DNSBL listings warrant monitoring, though no active malicious services were detected during analysis.

OWNERSHIP & INFRASTRUCTURE:

The address is allocated to OVH under customer block 15.235.98.0/24. DNS PTR records indicate association with "proxy-ca019-san235.ahrefs.net" under the ahrefs.net domain. Infrastructure classification confirms cloud compute hosting with firewall protection in place. No active services or open ports were detected.

GEOLOCATION VALIDATION:

Geolocation data indicates Singapore, but RTT measurements reveal significant validation anomalies. The observed RTT of 25ms is substantially below the minimum possible 121.6ms for a 6082km distance, triggering geovalidation violations. This discrepancy suggests either routing anomalies or potentially inaccurate geolocation reporting.

THREAT INDICATORS:

• DNSBL listings: 1 out of 8 total lists
• Abuse confidence score: Not available
• Known attacker flag: False
• Tor exit node: False
• Spam source: False
• Blacklist count: 0
• No known active threat campaigns

NETWORK CONTEXT & NEIGHBORHOOD:

The subnet 15.235.98.0/24 exhibits high abuse density with 217 active sibling IPs out of 256 total. Of these, 138 are classified as threats, while 96 show medium risk and only 4 show low risk. The inherited risk score for the subnet is 21. Control plane analysis shows the IP is not a route stable address (isRouteStable: false).

HISTORICAL OBSERVATIONS:

Analysis of 21 historical observations from June 2026 shows consistent network classification (OVH hosting) throughout the observation period. Abuse density classification remained stable at "high_abuse" with 0.5391 density. No persistent malicious behavior was detected across the observation window. Operator score of 0.2174 was classified as "Minimal."

RECOMMENDED ACTIONS:

Given the moderate risk score (40), DNSBL listing, and high-abuse neighborhood context, the following controls are recommended:

• Firewall: DROP all traffic from 15.235.98.235
• Cloudflare WAF: Block IP with expression `ip.src eq 15.235.98.235`
• AWS WAF: Add address 15.235.98.235/32 to block list
• nginx: `deny 15.235.98.235;`

RISK ASSESSMENT:

The IP presents moderate risk primarily due to neighborhood abuse density and DNSBL presence. No direct threat indicators (active campaigns, known attacker status) were identified. The geovalidation anomaly and persistent firewalling suggest limited visibility into actual traffic patterns. Recommended action is defensive blocking, particularly in contexts where the IP was previously observed in suspicious communications.

---

Prepared by: IPDebrief Intelligence Platform

Data Timestamp: 2026-06-19

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.