94.23.188.202📋 Copy

# IP Intelligence Briefing: 94.23.188.202/32

## Executive Summary

IP address 94.23.188.202 is a Moderate Risk (Score: 40) infrastructure address hosted within OVH cloud infrastructure in Roubaix, France. The IP resolves to the ahrefs.net domain and operates as a cloud/hosting service with no open services detected. Despite moderate individual risk scoring, the IP resides within a /24 subnet exhibiting critical abuse characteristics.

## Technical Profile

• Risk Score: 40 (Moderate Risk)
• Provider: OVH (ASN 16276)
• Organization: Ahrefs Pte Ltd Dmytro
• Location: Roubaix, Hauts-de-France, FR (500km accuracy radius)
• Infrastructure Type: Cloud Compute / Hosting
• Network Classification: Cloud infrastructure with firewall configuration active

## DNS Resolution & Host Identity

• PTR Hostname: proxy-fr008-san202.ahrefs.net
• Forward Resolution: proxy-fr008-san202.ahrefs.net (ahrefs.net)
• Forward Confirmed: No
• HTTP Services: None detected (Firewalled / No Services)
• DNSSEC Valid: Yes
• CAA Records: Present

## Network Context & Abuse Environment

The IP resides in subnet 94.23.188.0/24, which demonstrates critical abuse characteristics:

• Subnet Abuse Density: 0.875 (Critical)
• Classification: high_abuse
• Threat Siblings: 28 of 32 sibling IPs flagged as threats
• Active Siblings: 13
• Inherited Risk: 35

This subnet-level abuse density suggests the IP operates in a shared hosting or datacenter environment with significant abuse activity, despite the individual IP's moderate risk score.

## Threat Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• DNSBL Listings: 1 of 8 total lists
• Known Campaigns: None
• Campaign Likelihood: None

## Observed Behavior

Recent signal observations (2026-06-20) indicate:

• Cloud/hosting provider classification
• DNS infrastructure for legitimate ahrefs.net domain
• Abuse density signals at subnet level
• Geolocation inference from France

## Recommended Security Actions

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 94.23.188.202 -j DROP

# nftables

nft add rule inet filter input ip saddr 94.23.188.202 drop

# nginx

deny 94.23.188.202;

# pfSense

94.23.188.202/32

# Cloudflare WAF

Block 94.23.188.202 — IPDebrief risk score 40

# AWS WAF

Addresses: 94.23.188.202/32

Description: IPDebrief risk 40

```

## Intelligence Assessment

While IP 94.23.188.202 itself shows no direct threat indicators and maintains a moderate risk profile, the critical subnet abuse density (0.875) and high concentration of threat siblings (28/32) indicate this IP operates within a compromised or abuse-prone network environment. The moderate risk score may reflect legitimate hosting services operating alongside abusive tenants in the same OVH infrastructure.

Recommendation: Block traffic from this IP due to subnet-level abuse risk and inherited threat characteristics. Monitor for any service openings or behavioral changes in future observations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.