15.235.98.85📋 Copy

# IP Intelligence Briefing: 15.235.98.85

## Executive Summary

IP 15.235.98.85 is registered to OVH hosting infrastructure (ASN 16276, organization: Dmytro, Ahrefs Pte Ltd) and currently presents a moderate risk score of 40. The IP resolves to aresolvable hostname (proxy-ca019-san85.ahrefs.net) within the ahrefs.net domain. However, multiple geolocation inconsistencies and high-abuse subnet characteristics warrant continued monitoring.

## Network Classification

• Provider: OVH
• Infrastructure Type: Cloud Compute
• CIDR Block: 15.235.98.0/24
• Network Role: Firewalled / No Services
• Cloud Provider: Yes
• DNS Resolved: proxy-ca019-san85.ahrefs.net

## Risk Assessment

Current Risk Score: 40 (Moderate Risk)

Risk Profile:

• No active threat indicators (no known campaigns, not a Tor exit node, not classified as known attacker or spam source)
• Blacklist count: 0
• Control plane delegation shows minimal operator score (0.2174)
• No DNSBL listings observed

Geolocation Anomaly:

• Reported location: Singapore, CA
• Critical Finding: Geolocation implausibility detected. Probe measurements show 27ms RTT, but minimum possible RTT for 6,082km distance is 121.6ms. This indicates the reported geolocation is unreliable.
• geoPlausible flag: false
• 5 probe points with average RTT: 30.6ms

## Subnet Analysis

Subnet: 15.235.98.0/24

• Abuse Density: 0.625 (High)
• Classification: high_abuse
• Total Siblings: 256
• Active Siblings: 229
• Threat Siblings: 160

The IP resides in a subnet with significant abuse activity. Of 256 total sibling IPs, 160 have been identified as threats.

## Observation History

Recent signal observations (June 2026) indicate:

• Consistent high_abuse classification for the /24 subnet
• Persistent RTT/geolocation validation failures
• Multiple control plane assessments showing minimal operator risk
• No persistent malicious threat pattern detected

## Relationships

• 42 total relationships identified
• Primary association: Same Network (OVH-CUST-281059698)
• No cross-organization or cross-network relationships detected

## Recommended Actions

Despite moderate risk classification, the high-abuse subnet context and geolocation inconsistencies support defensive blocking:

```bash

# iptables

iptables -A INPUT -s 15.235.98.85 -j DROP

# nftables

nft add rule inet filter input ip saddr 15.235.98.85 drop

# pfSense

15.235.98.85/32

# Cloudflare WAF

Block 15.235.98.85 — IPDebrief risk score 40

# AWS WAF

Addresses: ["15.235.98.85/32"]

```

## Intelligence Notes

• IP appears to be part of aresolvable proxy infrastructure for ahrefs.net
• High-abuse subnet context suggests shared infrastructure risk
• Geolocation data should not be relied upon for this IP
• No direct threat indicators present, but subnet-level risk is elevated

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.