92.222.108.105📋 Copy

# INTELLIGENCE BRIEFING: 92.222.108.105

## Executive Summary

IP address 92.222.108.105 presents a MODERATE RISK profile (Risk Score: 50) operating within a high-abuse density subnet (92.222.108.0/24). The address is associated with OVH cloud infrastructure in Paris, France, and resolves to an Ahrefs-hosted proxy hostname. No active threat indicators were detected for this specific IP, but the subnet exhibits elevated abuse characteristics requiring defensive monitoring.

---

## Infrastructure Profile

---

## Threat Assessment

Active Threat Indicators: None detected

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Known Campaigns: None matched
• DNSBL Listings: 2 of 8 lists

Risk Mitigating Factors:

• Operator score rated "Minimal" (0.2174)
• No service banners or open ports detected
• Forward DNS resolution confirmed
• DNSSEC valid with CAA records present

---

## Network Environment Analysis

Subnet: 92.222.108.0/24

• Abuse Density: 0.7742 (High)
• Classification: High Abuse
• Total Sibling IPs: 31
• Active Sibling IPs: 27
• Threat Sibling IPs: 24
• Inherited Risk Score: 30

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 30
• Low Risk: 0

All 30 sampled neighboring IPs exhibit risk scores of 40-50, indicating consistent medium-risk classification across the subnet. This suggests the subnet is actively used for hosting services, potentially with varying levels of legitimate and potentially compromised endpoints.

---

## Historical Trend Analysis

Observation Period: 2026-06-15 to 2026-06-20

• Total Observations: 23
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0
• Route Stability: False (routing changes detected)

Signal Trends:

• Operator scores remained consistently "Minimal" (0.2174) across all observations
• Subnet abuse density signals maintained "high_abuse" classification
• No degradation or escalation of threat signals observed
• Stability remains low due to route instability

---

## Relationship Graph

Total Relationships: 44

• Network Relationships: 39+ entries pointing to OVH_282114227
• All relationships indicate same-network association within OVH infrastructure
• No direct links to organizations, hostnames, or certificates beyond network-level associations

---

## Defensive Recommendations

Recommended Actions:

1. Block at perimeter if traffic patterns indicate suspicious behavior

2. Monitor subnet 92.222.108.0/24 for elevated activity given high abuse density

3. Implement rate limiting for the /24 subnet rather than individual IP blocking

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 92.222.108.105 -j DROP

# nftables

nft add rule inet filter input ip saddr 92.222.108.105 drop

# Cloudflare WAF

{"description":"Block 92.222.108.105 — IPDebrief risk score 50","action":"block","filter":{"expression":"ip.src eq 92.222.108.105"}}

# AWS WAF

{"Addresses":["92.222.108.105/32"],"Description":"IPDebrief risk 50"}

```

---

## Operational Context

This IP is part of a shared cloud infrastructure environment. The PTR hostname (proxy-fr002-san105.ahrefs.net) suggests legitimate hosting use, likely related to SEO or web analytics services provided by Ahrefs. However, the high-abuse subnet classification indicates the IP space is frequently associated with security incidents.

Assessment: Monitor rather than block immediately. The moderate risk score combined with cloud hosting context suggests this may be legitimate traffic. Implement logging and behavioral analysis to identify if specific sessions exhibit malicious patterns before applying blocking measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.