RDAPNetwork GIR_SER-NET (212.192.14.0 - 212.192.14.255), RU; Evgenii M., interlir-mnt, lir-ae-rcstechnologies-1-MNT.
- Org
- Evgenii M., interlir-mnt, lir-ae-rcstechnologies-1-MNT
- Range
- 212.192.14.0 - 212.192.14.255
- Country
- RU
- Network
- GIR_SER-NET
Verdict
MALICIOUSMedium confidence
2Supporting signals
2Independent sources
2Recent observations
82 / 100Threat score
Why the engine decided this
Deterministic engine · activity high- THREATFOX_MATCH ThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITY Strongest malicious evidence is 30 days old or less.
Key indicators
- IP address
- 212.192.14.31
- ASN
- AS207713
- Holder
- GIR-AS GLOBAL INTERNET SOLUTIONS LLC
- Country
- Russia (RU)
- Network
- GIR_SER-NET
- Prefix
- 212.192.14.0/24
- Open ports
- None recorded
- Tor exit
- No
- First seen
- 2026-09-26 (1 day before · ThreatFox)
- Last seen
- 2026-09-26 (1 day before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 ThreatFox | Listed as botnet_cc for Potassium at 100% confidence, 1 day ago. | 100% | 1 day recent | Strong |
 VirusTotal | 5/91 vendors (5.5%) flag it: a low detection ratio. | 5/91 | 1 day recent | Suspicious |
| RDAP | Network GIR_SER-NET (212.192.14.0 - 212.192.14.255), RU; Evgenii M., interlir-mnt, lir-ae-rcstechnologies-1-MNT. | — | — | Context |
 RIPEstat | Announced in 212.192.14.0/24 by AS207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC). | — | — | Context |
Coverage · checked, no record: GreyNoise, Shodan, AlienVault OTX, AbuseIPDB, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list, DShield · failed: none
Analyst summary
Consistent with engineMalicious, medium confidence. Listed as botnet_cc for Potassium at 100% confidence, 1 day ago. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for Potassium at 100% confidence, 1 day ago.
- [VirusTotal] 5/91 vendors (5.5%) flag it: a low detection ratio.
Only one source family reports malicious activity.
Attribution
Links the indicator to Potassium activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyNo group is directly linked to this indicator by any source.
All evidence
13 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| ThreatFox | Listed as botnet_cc for Potassium at 100% confidence, 1 day ago. | 100% | 1 day recent | Strong |
| VirusTotal | 5/91 vendors (5.5%) flag it: a low detection ratio. | 5/91 | 1 day recent | Suspicious |
| RDAP | Network GIR_SER-NET (212.192.14.0 - 212.192.14.255), RU; Evgenii M., interlir-mnt, lir-ae-rcstechnologies-1-MNT. | — | — | Context |
| RIPEstat | Announced in 212.192.14.0/24 by AS207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC). | — | — | Context |
 GreyNoise | No record. | — | — | No record |
 Shodan | No record. | — | — | No record |
 AlienVault OTX | No record. | — | — | No record |
 AbuseIPDB | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
| DShield | Not among the 1,000 IPs most reported by DShield sensors today. | — | — | No record |
Engine rules applied
- THREATFOX_MATCHThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITYStrongest malicious evidence is 30 days old or less.
- SINGLE_SOURCE_ONLYOnly one source family provides malicious evidence.
Analyst summary
Consistent with engineMalicious, medium confidence. Listed as botnet_cc for Potassium at 100% confidence, 1 day ago. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for Potassium at 100% confidence, 1 day ago.
- [VirusTotal] 5/91 vendors (5.5%) flag it: a low detection ratio.
Only one source family reports malicious activity.
Attribution
Links the indicator to Potassium activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 212.192.14.31
- ASN
- AS207713
- Holder
- GIR-AS GLOBAL INTERNET SOLUTIONS LLC
- Country
- Russia (RU)
- Network
- GIR_SER-NET
- Prefix
- 212.192.14.0/24
- Open ports
- None recorded
- Tor exit
- No
- First seen
- 2026-09-26 (1 day before · ThreatFox)
- Last seen
- 2026-09-26 (1 day before)
By source
RDAPRIPEstatAnnounced in 212.192.14.0/24 by AS207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC).
- ASN
- 207713
- Holder
- GIR-AS GLOBAL INTERNET SOLUTIONS LLC
- Prefix
- 212.192.14.0/24
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
Links the indicator to Potassium activity; this does not identify a specific threat actor or implicate the hosting provider.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-09-26VirusTotal: 5/91 vendors (5.5%) flag it: a low detection ratio
- 2026-09-26ThreatFox: Listed as botnet_cc for Potassium at 100% confidence, 1 day ago
- 2026-09-27Investigated
Run history
2 collections of this indicator- 2026-09-27MALICIOUS82Live lookupsShown
- 2026-09-26MALICIOUS82Live lookupsOpen
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 212.192.14.31:15987 in the last 30 days.
- pivotPassive DNS: domains that resolved to 212.192.14.31.
- blockBlock 212.192.14.31 at the perimeter.
- enrichCheck other addresses in 212.192.14.0/24 against threat feeds.
Pivot to other tools
Opens the indicator in the source's own site (new tab).