15.235.98.7📋 Copy

# IP INTELLIGENCE BRIEFING: 15.235.98.7/32

## Executive Summary

IP 15.235.98.7 is a moderate-risk cloud hosting address associated with Ahrefs infrastructure on OVH SAS infrastructure. The IP exhibits high subnet abuse density with significant threat activity in its /24 neighborhood. No direct malicious indicators were observed, though geolocation inconsistencies and DNSBL listings warrant monitoring.

---

## Infrastructure Profile

• Risk Score: 40 (Moderate Risk)
• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Network Name: OVH-CUST-281059698
• Geolocation: Singapore (CA) – geo consensus flagged as false
• Infrastructure Type: Cloud Compute / Hosting
• Classification: Firewalled / No Services

## DNS & Service Analysis

• PTR Hostnames: proxy-ca019-san7.ahrefs.net
• Forward Resolution: Confirmed to ahrefs.net domain
• DNSSEC: Valid
• CAA Records: Present
• Open Ports: None detected
• TLS/HTTP Services: None detected (firewalled)
• DNSBL Listings: 1 listing (of 8 total lists)

---

## Threat Indicators

• Abuse Confidence Score: Not calculated
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Threat Indicators: None directly associated with this IP
• Campaign Correlation: No matches
• Known Campaigns: None

---

## Neighborhood Analysis (15.235.98.0/24)

• Abuse Density: 0.6875 (High Abuse)
• Classification: High Abuse
• Active Siblings: 240 of 256 total
• Threat Siblings: 176
• Risk Distribution: 100 medium-risk neighbors, 0 high-risk, 0 low-risk
• Inherited Risk Score: 27

---

## Observation History (21 Observations)

Recent activity shows:

• DNS resolution to ahrefs.net confirmed (2026-06-27)
• Subnet abuse density fluctuated between 0.5938–0.6875
• Geolocation inconsistencies observed (US vs Singapore)
• Operator score: 0.2174 (Minimal)
• No persistent malicious behavior detected

---

## Relationship Graph

• Primary Association: OVH-CUST-281059698 network
• Network Type: Same Network (47 relationship entries)
• Correlated Entities: Primarily subnet-based associations
• BGP Prefix: 15.235.0.0/17
• Route Stability: Unstable (route changes in last 30 days)

---

## Recommended Actions

Based on the IP's risk profile and neighborhood characteristics:

Immediate:

• Monitor for outbound traffic to known C2 infrastructure
• Block or rate-limit if traffic patterns match known attack signatures

Short-term:

• Add to threat monitoring watchlist due to high-abuse subnet
• Correlate with similar Ahrefs-related infrastructure
• Implement logging for all traffic to/from this IP

Long-term:

• Evaluate subnet-level filtering for 15.235.98.0/24
• Monitor for DNS query anomalies targeting ahrefs.net
• Consider geo-blocking if legitimate traffic patterns don't match Singapore routing

---

## SOC Analyst Notes

This IP presents a moderate risk primarily driven by subnet-level abuse rather than individual malicious activity. The Ahrefs association suggests legitimate use, but the high-abuse neighborhood requires ongoing monitoring. Geo inconsistencies should be investigated if traffic originates from unexpected locations. No immediate blocking is recommended, but enhanced logging and correlation with threat intelligence feeds is advised.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.