15.235.98.77📋 Copy

# IP Intelligence Briefing: 15.235.98.77/32

Date: June 21, 2026 | Classification: Moderate Risk (Score: 40)

## Executive Summary

IP 15.235.98.77 is a cloud-hosted infrastructure address assigned to OVH SAS (AS16276) under organization "Dmytro, Ahrefs Pte Ltd". The IP resolves to Ahrefs.net infrastructure but exhibits geolocation inconsistencies and is listed on one of eight DNS blacklists. While no active attack indicators were observed, the /24 subnet demonstrates high abuse density (76.17%), warranting monitoring for lateral threat activity.

---

## Technical Profile

Ownership & Registration:

• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• CIDR Block: 15.235.98.0/24
• Network Classification: CloudCompute / Hosting Infrastructure

DNS Resolution:

• PTR Record: proxy-ca019-san77.ahrefs.net
• Forward Resolution: proxy-ca019-san77.ahrefs.net
• Domain: ahrefs.net
• Forward Confirmation: False

Network Services:

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Classification: Firewalled / No Services

---

## Risk Assessment

Threat Indicators:

• Risk Score: 40/100 (Moderate)
• Abuse Confidence: Null
• Blacklist Status: Listed on 1 of 8 DNSBLs
• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Geolocation Discrepancy:

• Claimed Location: Canada (CA)
• Coordinate Location: Singapore (~6,082 km from claimed location)
• RTT Violation: 27ms observed vs. 121.6ms minimum possible for claimed distance
• Validated: False (inconsistent geolocation data)

Control Plane:

• BGP Prefix: 15.235.0.0/17
• Origin ASN: 16276
• Route Stability: False
• DNSSEC Valid: True

---

## Neighborhood Analysis

Subnet: 15.235.98.0/24

• Abuse Density: 76.17% (High Abuse)
• Total Siblings: 256
• Active Siblings: 248
• Threat Siblings: 195

Risk Distribution (Sample of 100 Neighbors):

• High Risk: 0
• Medium Risk: 100
• Low Risk: 0

Key Neighbors:

---

## Observation History

Recent signals (June 21, 2026) indicate:

• Subnet abuse density observed at 76.17%
• Geovalidation failures due to RTT distance violations
• DNS association with ahrefs.net infrastructure
• Pulse detections from AlienVault OTX (3 pulses)
• DNSBL listings with maximum severity: High

---

## Relationship Graph

Primary Associations:

• Network: OVH-CUST-281059698 (26 relationships)
• DNS Hostname: proxy-ca019-san77.ahrefs.net (13 relationships)

---

## Recommendations

Immediate Actions:

1. Monitor inbound/outbound traffic for anomalous patterns from this /24 subnet

2. Review firewall rules to ensure no unauthorized access to Ahrefs.net infrastructure

3. Investigate the 195 threat siblings in the subnet for potential lateral movement

4. Verify legitimate business justification for traffic from this IP

Mitigation:

• No immediate blocking recommended (no active attack indicators)
• Consider enhanced logging for first-hop connections
• Monitor for changes in geolocation patterns or service exposure

SOC Priority: Medium – Infrastructure hosting requires monitoring but shows no active exploitation indicators.

---

*Generated by IPDebrief Intelligence Platform | Data current as of June 21, 2026*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.