92.222.104.217📋 Copy

# IP Intelligence Briefing: 92.222.104.217/32

Classification: Moderate Risk | Risk Score: 40/100 | Generated: 2026-06-14

---

## Executive Summary

IP address 92.222.104.217 is a cloud computing infrastructure endpoint operated by OVH, located in Paris, France. The IP is associated with Ahrefs Pte Ltd (ASN 16276) and resolves to hostname proxy-fr006-san217.ahrefs.net. The endpoint exhibits moderate risk characteristics with one DNSBL listing and no active open ports or services. The immediate /24 subnet demonstrates elevated abuse density with uniformly moderate-risk profiles across all peer addresses.

---

## Network Profile

---

## Threat Assessment

Current Risk Score: 40/100 (Moderate)

Threat Indicators:

• DNSBL Listed: 1 of 8 total lists
• Abuse Confidence Score: Not calculated
• Known Campaigns: None detected
• Is Tor Exit/Attacker/Spam Source: No
• Open Ports/Services: None detected (firewalled/no services)

Operator Score: 0.2174 (Minimal)

---

## Subnet Analysis (92.222.104.0/24)

Abuse Density: High (0.9062)

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 31
• Low Risk: 0

All 31 analyzed neighbors in the /24 subnet maintain risk scores between 40-50, indicating a consistently utilized OVH cloud infrastructure block with no outliers.

---

## Observation History

Total Observations: 23 signals

Recent Activity (2026-06-14):

• Geolocation signals confirm Paris, FR placement (500km accuracy radius)
• Operator scoring signals indicate minimal threat profile
• DNSBL listing detected with high severity classification
• Network classification consistently identifies as cloud hosting infrastructure

Temporal Indicators:

• Ownership Changes: 0 (stable)
• Threat Persistence Days: 0
• Is Persistently Malicious: No
• Threat Observation Count: 1

---

## Relationship Graph

Total Relationships: 68

Primary associations:

• Network: OVH_282114231 (repeated 68 times - indicates network-wide grouping)
• Organization: Ahrefs Pte Ltd (via ASN 16276)
• DNS: ahrefs.net domain ecosystem

The relationship graph shows strong network-level connectivity within OVH infrastructure without significant cross-organization or campaign-level associations.

---

## Recommended Actions

Immediate Mitigation:

Due to DNSBL listing and elevated subnet abuse density, the following controls are recommended:

Firewall Rules:

• iptables: `iptables -A INPUT -s 92.222.104.217 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 92.222.104.217 drop`
• nginx: `deny 92.222.104.217;`
• pfSense: `92.222.104.217/32`
• Cloudflare WAF: Block with filter expression `ip.src eq 92.222.104.217`
• AWS WAF: Address `92.222.104.217/32` with description "IPDebrief risk 40"

Extended Mitigation:

Consider implementing subnet-level blocking for 92.222.104.0/24 given the 0.9062 abuse density and uniform moderate-risk profiles across all sibling addresses.

---

## Intelligence Conclusions

1. Infrastructure Context: This is legitimate cloud hosting infrastructure associated with Ahrefs, but the subnet shows elevated abuse density typical of high-density cloud hosting providers.

2. Risk Profile: Moderate risk score of 40 with one DNSBL listing warrants defensive blocking in high-security environments.

3. Subnet Correlation: All 31 neighbors in the /24 subnet share similar risk profiles (40-50), suggesting systemic risk at the subnet level rather than isolated endpoint behavior.

4. Actionability: The empty recommendation list in the profile indicates no specific threat indicators were detected, but the DNSBL listing and subnet abuse density support defensive blocking decisions.

Recommendation: Implement firewall rules to drop traffic from 92.222.104.217. Consider broader subnet-level controls for 92.222.104.0/24 if threat context permits.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.