15.235.98.61📋 Copy

Threat Intelligence Briefing: IP 15.235.98.61/32

Date: June 14, 2026

---

**1. IP Profile**

• Risk Score: 25 (Low Risk)
• Ownership: Registered to Ahrefs Pte Ltd (OVH customer, ASN 16276).
• Geolocation:

- Country: Canada (CA) | City: Singapore (discrepancy noted).

- Latitude/Longitude: Unavailable.

- Distance from probe: ~6,082 km (RTT 30ms, flagged as implausible).

• Network Role: Hosting provider (OVH) – likely a cloud/server infrastructure.
• DNS:

- PTR hostname: `proxy-ca019-san61.ahrefs.net` (linked to Ahrefs domain).

- No email authentication (SPF/DKIM) detected.

• Services: No open ports or TLS certificates observed.

---

**2. Observation History**

• Geo Validation Anomaly:

- RTT of 30ms for 6,082 km distance (minimum plausible RTT: 121.6ms).

- Suggests potential spoofing, proxy, or misconfigured geolocation.

• Network Classification:

- Identified as a cloud-hosted infrastructure (OVH).

- Subnet abuse density: 39.13% (mixed risk, 99 threat siblings in /24).

• Threat Indicators:

- No direct malicious activity (no blacklists, campaigns, or spam).

- Subnet contains 180 active IPs, 99 flagged as threats.

---

**3. Relationships**

• Network Affiliation:

- Part of OVH-CUST-281059698 (customer network).

- Linked to Ahrefs Pte Ltd (SEO/analysis services).

• DNS Connections:

- Resolves to `ahrefs.net` (no email auth, no domain reputation).

• BGP Context:

- Origin ASN: AS16276 (OVH).

- BGP prefix: `15.235.0.0/17` (stable route, no RPKI issues).

---

**4. Subnet Analysis**

• Subnet: `15.235.98.61/24`
• Risk Distribution:

- High Risk: 0 IPs

- Medium Risk: 19 IPs

- Low Risk: 81 IPs

• Abuse Density: 39.13% (moderate risk).
• Neighbor Highlights:

- 99 IPs in subnet flagged as threats.

- 180 active IPs, 253 total siblings.

---

**5. Recommendations**

• Monitor Subnet Activity: The subnet’s abuse density suggests potential lateral movement or shared infrastructure risks.
• Verify Geolocation: Investigate the Singapore/Canada discrepancy; could indicate misconfiguration or spoofing.
• Check Ahrefs Context: Confirm legitimacy of DNS ties to Ahrefs (no direct malicious ties found).
• Network Segmentation: Consider isolating high-risk subnet siblings to mitigate potential exposure.

Conclusion: This IP is low-risk but resides in a subnet with notable abuse activity. SOC teams should prioritize monitoring the broader network context and validate geolocation anomalies. No immediate action required for the IP itself, but subnet-level vigilance is advised.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.