15.235.98.73📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 15.235.98.73/32

Classification: Moderate Risk | Risk Score: 40/100

---

## EXECUTIVE SUMMARY

IP 15.235.98.73 is a cloud compute infrastructure endpoint hosted by OVH (ASN 16276) with moderate risk characteristics. The IP resolves to hostnames under the ahrefs.net domain but operates as a firewalled endpoint with no open services. Geolocation validation reveals significant anomalies, with claimed Singapore location conflicting with RTT measurements. The subnet exhibits elevated abuse density, with 188 threat-identified neighbors across 256 active siblings.

---

## NETWORK ATTRIBUTES

---

## GEOLOCATION ANALYSIS

Assessment: Geolocation data is implausible. The 6,082 km distance to claimed location would require minimum RTT of 121.6 ms, but observed RTT is 25-33 ms. This indicates the IP is not physically located in Singapore.

---

## THREAT INDICATORS

• Abuse Confidence Score: Not reported
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• Threat Feeds: None identified
• Known Campaigns: None

Threat Persistence: 0 days; IP is not persistently malicious.

---

## DNS ANALYSIS

• PTR Hostnames: proxy-ca019-san73.ahrefs.net
• Forward Resolution: proxy-ca019-san73.ahrefs.net
• Forward Confirmed: No
• Email Authentication: No SPF/DMARC records
• HTTP Services: None (firewalled)

---

## SUBNET ANALYSIS (15.235.98.0/24)

Assessment: The /24 subnet demonstrates elevated abuse activity with 188 threat-flagged neighbors (73% of active siblings). This indicates a shared infrastructure environment with higher-than-average malicious activity.

---

## OBSERVATION HISTORY

Recent Activity (Last 20 Observations):

• June 28, 2026: Geolocation signal with RTT violation (25 ms observed vs 121.6 ms minimum)
• June 20, 2026: Multiple signals including abuse density classification (high_abuse), operator score (0.2174), and subnet abuse metrics
• Threat Observation Count: 1
• Ownership Changes: 0

---

## RELATIONSHIP GRAPH

• Total Relationships: 38
• Primary Association: OVH-CUST-281059698 (Same Network)
• Related Entities: Multiple network-level relationships to same infrastructure block

---

## SECURITY RECOMMENDATIONS

Risk-Based Action: Block (Risk Score 40 + High Abuse Subnet)

Firewall Rules:

• iptables: `iptables -A INPUT -s 15.235.98.73 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 15.235.98.73 drop`
• nginx: `deny 15.235.98.73;`
• pfSense: `15.235.98.73/32`
• Cloudflare WAF: Block IP with expression `ip.src eq 15.235.98.73`
• AWS WAF: Add `15.235.98.73/32` to block list

---

## ANALYST NOTES

1. Subnet Correlation: Consider blocking entire /24 subnet (15.235.98.0/24) given 73% threat density among neighbors.

2. Geolocation Anomaly: RTT violation suggests spoofed or misconfigured location data; treat location claims as unreliable.

3. Ahrefs Association: While DNS resolves to ahrefs.net, this does not indicate legitimate ahrefs infrastructure (ahrefs.net is not owned by the organization listed in ASN records).

4. Cloud Infrastructure: No open services detected; may be used for backend services, botnet command-and-control, or as a relay.

---

Report Generated: IPDebrief Intelligence Platform

Analysis Date: Current timestamp

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.