92.222.104.203📋 Copy

IP Intelligence Briefing: 92.222.104.203

*Generated via IPDebrief analysis*

---

**Key Risk Indicators**

• Risk Score: 40 (Moderate Risk)
• Provider: OVH (CloudCompute infrastructure)
• Ownership: Ahrefs Pte Ltd Dmytro (legitimate entity)
• Geolocation: Paris, France (FR)
• Network Role: Hosting provider infrastructure (cloud-based, no direct services exposed)
• Threat Status: No malicious indicators, no known campaigns, no blacklist entries

---

**Observation History**

• Recent Signals:

- DNS records linked to `proxy-fr006-san203.ahrefs.net` (Ahrefs subdomain).

- Network classification as "CloudCompute" with OVH provider.

- DNSSEC and CAA records validated, no domain misconfigurations.

• Trend: No significant changes in risk profile over the past 30 days.

---

**Network Relationships**

• Subnet: 92.222.104.203/24
• Neighbors:

- 31 IPs in subnet, 28 actively reported.

- Abuse Density: 71.88% (high abuse risk in subnet).

- Threat Siblings: 23 IPs with elevated risk scores (40–50).

• Associations:

- Linked to OVH network `OVH_282114231`.

- DNS hostname `proxy-fr006-san203.ahrefs.net` (Ahrefs Pte Ltd).

---

**Subnet Context**

• Abuse Classification: High abuse density (0.7188).
• Neighbor Risk: Most IPs in subnet have moderate risk scores (40–50), suggesting potential for malicious activity within the same infrastructure.
• Subnet Stability: Route stability flagged as "low" (IPDebrief).

---

**Actionable Intelligence**

1. Monitor Subnet: High abuse density in the 92.222.104.0/24 subnet warrants closer inspection of neighboring IPs.

2. Verify DNS Associations: Confirm legitimacy of `proxy-fr006-san203.ahrefs.net` (Ahrefs is a legitimate company, but ensure no subdomain hijacking).

3. Network Segmentation: Consider isolating cloud-based infrastructure to limit lateral movement risks.

4. Threat Hunting: Investigate if any of the 23 high-risk sibling IPs are linked to malicious campaigns or C2 activity.

---

Conclusion:

The IP 92.222.104.203 is associated with legitimate cloud infrastructure (OVH, Ahrefs), but its subnet exhibits high abuse density. While the IP itself shows no direct malicious indicators, the environment may host other risky assets. SOC teams should prioritize monitoring the subnet and validating DNS/ownership relationships.

*Generated by IPDebrief | Last Updated: 2026-06-15*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.