94.23.188.214📋 Copy

# IP INTELLIGENCE BRIEFING: 94.23.188.214/32

## EXECUTIVE SUMMARY

IP address 94.23.188.214/32 is classified as MODERATE RISK (risk score: 50) with cloud/hosting infrastructure characteristics. The IP is associated with OVH cloud infrastructure in France (Roubaix, Hauts-de-France) and resolves to Ahrefs proxy infrastructure. No active threat indicators or campaign correlations were observed.

## OWNERSHIP & INFRASTRUCTURE

• ASN: 16276 (OVH)
• Organization: Ahrefs Pte Ltd Dmytro
• Geolocation: France (FR), Roubaix, Hauts-de-France
• Infrastructure Type: Cloud Compute (OVH hosting provider)
• Network Role: Firewalled / No Services Detected
• Registration: RIR RIPE Network

## DNS & HOSTNAME ASSOCIATIONS

• PTR Hostnames: proxy-fr008-san214.ahrefs.net
• Forward Resolution: proxy-fr008-san214.ahrefs.net
• Domain: ahrefs.net
• HTTP Services: None detected (firewalled)

## THREAT INDICATORS & REPUTATION

• Risk Score: 50 (Moderate)
• Abuse Confidence Score: Not available
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Listings: 2 of 8 total lists
• Threat Persistence: 0 days (transient activity)
• Is Persistently Malicious: No

## NEIGHBORHOOD ANALYSIS (94.23.188.0/24)

• Total Sibling IPs: 32
• Active Siblings: 13
• Threat Siblings: 28
• Abuse Density: 0.875 (High Abuse Classification)
• Subnet Risk: Inherited risk score of 35
• Risk Distribution: 20 medium-risk, 11 low-risk, 0 high-risk neighbors

Multiple sibling IPs within the /24 subnet share similar risk profiles (risk score 50), indicating potential shared infrastructure or abuse patterns.

## OBSERVATION HISTORY

• Total Observations: 19 signals recorded
• Recent Activity: June 2026 observations
• Geolocation Signals: 190.23 km coordinate inference (France)
• Network Classification: High abuse subnet classification observed
• Threat Indicators: No persistent malicious behavior detected

## NETWORK CLASSIFICATION

• Provider: OVH
• Connection Type: Cloud-based
• Infrastructure: Hosting/Cloud provider
• Connection Status: No active services (firewalled)

## RECOMMENDED ACTIONS

Based on the moderate risk classification and cloud infrastructure context:

• Allow: No immediate blocking required given legitimate Ahrefs association
• Monitor: Watch for unusual traffic patterns from this IP range
• Block: Consider blocking if traffic patterns indicate abuse or if threat indicators emerge
• Firewall Rules: No specific iptables/nftables rules recommended at this time

## ANALYST NOTES

This IP represents legitimate Ahrefs proxy infrastructure hosted on OVH cloud. While the subnet shows elevated abuse density (0.875), this specific IP has no active threat indicators. Monitor for changes in DNS associations or emergence of threat indicators. The high number of threat-sibling IPs (28) within the /24 suggests the infrastructure may be shared with other entities or used for multiple purposes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.