15.235.98.6📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 15.235.98.6/32

Date: 2026-06-23

Analyst: IPDebrief Automated Intelligence System

---

## EXECUTIVE SUMMARY

IP 15.235.98.6 is classified as MODERATE RISK (risk score: 40) with a network role of cloud compute hosting infrastructure. The IP resolves to ares.net domain infrastructure and operates within OVH cloud provider network OVH-CUST-281059698. While the IP itself shows no active threat indicators, its /24 subnet demonstrates elevated abuse characteristics.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Name: OVH-CUST-281059698
• CIDR Block: 15.235.98.0/24
• Infrastructure Type: CloudCompute / Hosting
• Provider: OVH

Geolocation Discrepancy Detected:

• Country Code: CA (Canada)
• Reported City: Singapore
• Distance Validation: 6,082 km with 30ms RTT violates minimum possible 121.6ms threshold
• Status: GEOLOCATION PLAUSIBLE = FALSE

---

## NETWORK CLASSIFICATION

• Connection Type: Cloud Infrastructure
• Is Cloud: YES
• Is Hosting: YES
• Is CDN: NO
• Is VPN/Proxy/Tor: NO
• Is Residential: NO
• Open Ports: NONE DETECTED
• Services: FIREWALLED / NO SERVICES

---

## DNS & EMAIL INFRASTRUCTURE

• PTR Hostnames: proxy-ca019-san6.ahrefs.net
• Forward Resolution: proxy-ca019-san6.ahrefs.net
• Domain: ahrefs.net (SEO analytics platform)
• Forward Confirmed: NO
• Email Auth: SPF: NO | DMARC: NO | TXT Records: 0

---

## THREAT ASSESSMENT

Current Threat Indicators

• Abuse Confidence Score: NULL
• Blacklist Count: 0
• Is Known Attacker: NO
• Is Spam Source: NO
• Is Tor Exit Node: NO
• Known Campaigns: NONE
• Threat Feeds: EMPTY

Control Plane Analysis

• DNSBL Listed: 1 of 8 total lists
• Operator Score: 0.2174 (MINIMAL)
• RPKI State: NULL
• Route Stability: UNSTABLE
• BGP Prefix: 15.235.0.0/17

---

## SUBNET CONTEXT (15.235.98.0/24)

• Subnet Classification: HIGH_ABUSE
• Abuse Density: 0.6719 (67.19%)
• Total Siblings: 256 IPs
• Active Siblings: 239 IPs
• Threat Siblings: 172 IPs
• Inherited Risk Score: 26

Neighborhood Risk Profile:

• Medium Risk IPs: 100
• High Risk IPs: 0
• Low Risk IPs: 0

---

## OBSERVATION HISTORY

Total Observations: 22 signals

Recent Activity Period: 2026-06-18 to 2026-06-22

Key Historical Signals:

• 2026-06-18: Subnet abuse density observation (0.6719, HIGH_ABUSE classification)
• 2026-06-18: Ownership stability confirmation (0 changes, non-persistently malicious)
• 2026-06-18: Operator score baseline (0.2174, MINIMAL)
• 2026-06-22: Control plane signal (MINIMAL label, score 0.1)

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence: 0 days
• Persistently Malicious: NO

---

## INTERCONNECTED ENTITIES

Relationship Graph: 64 relationships identified

• Primary Association: Same Network (OVH-CUST-281059698)
• Network Type: Cloud Compute Customer Block

---

## RECOMMENDED ACTIONS

Risk Score: 40 (MODERATE)

Firewall Rules Provided:

```

iptables: iptables -A INPUT -s 15.235.98.6 -j DROP

nftables: nft add rule inet filter input ip saddr 15.235.98.6 drop

nginx: deny 15.235.98.6;

pfSense: 15.235.98.6/32

Cloudflare: Block 15.235.98.6 — IPDebrief risk score 40

AWS WAF: Addresses: 15.235.98.6/32

```

---

## ANALYST NOTES

1. Subnet Context: While the target IP shows moderate risk individually, the /24 subnet exhibits high abuse density (67.19%) with 172 of 256 sibling IPs flagged as threat sources.

2. Infrastructure Legitimacy: The IP resolves to ahrefs.net, a legitimate SEO analytics platform provider. However, the geolocation discrepancy (CA/Singapore) warrants monitoring.

3. No Active Services: No open ports or services detected on the target IP. The infrastructure appears firewalled.

4. Action Threshold: Risk score of 40 is moderate. Consider blocking if:

- Outbound connections observed

- Traffic matches known threat patterns

- Subnet abuse density triggers policy thresholds

5. Recommendation: Monitor traffic patterns rather than immediate blocking. The IP operates within legitimate cloud hosting infrastructure with no current threat indicators.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.