RDAPNetwork INETTECH (89.23.113.0 - 89.23.113.255), RU; Evgenii M., INETTECH-MNT, IPMAGNAT-MNT.
- Org
- Evgenii M., INETTECH-MNT, IPMAGNAT-MNT
- Range
- 89.23.113.0 - 89.23.113.255
- Country
- RU
- Network
- INETTECH
Verdict
MALICIOUSMedium confidence
1Supporting signals
1Independent sources
1Recent observations
82 / 100Threat score
Why the engine decided this
Deterministic engine · activity high- THREATFOX_MATCH ThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITY Strongest malicious evidence is 30 days old or less.
Key indicators
- IP address
- 89.23.113.104
- ASN
- AS207713
- Holder
- GIR-AS GLOBAL INTERNET SOLUTIONS LLC
- Country
- Russia (RU)
- Network
- INETTECH
- Prefix
- 89.23.113.0/24
- Open ports
- None recorded
- Tor exit
- No
- First seen
- 2026-10-03 (0 days before · ThreatFox)
- Last seen
- 2026-10-03 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 ThreatFox | Listed as botnet_cc for Potassium at 100% confidence, today. | 100% | 0 days recent | Strong |
 VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
| RDAP | Network INETTECH (89.23.113.0 - 89.23.113.255), RU; Evgenii M., INETTECH-MNT, IPMAGNAT-MNT. | — | — | Context |
 RIPEstat | Announced in 89.23.113.0/24 by AS207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC). | — | — | Context |
Coverage · checked, no record: GreyNoise, Shodan, AlienVault OTX, AbuseIPDB, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list, VPN ranges, CrowdSec, Spamhaus DROP, Reverse DNS (ip.thc.org), DShield · failed: none
Analyst summary
Consistent with engineMalicious, medium confidence. Listed as botnet_cc for Potassium at 100% confidence, today. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for Potassium at 100% confidence, today.
Only one source family reports malicious activity.
Attribution
Links the indicator to Potassium activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
All evidence
17 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| ThreatFox | Listed as botnet_cc for Potassium at 100% confidence, today. | 100% | 0 days recent | Strong |
| VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
| RDAP | Network INETTECH (89.23.113.0 - 89.23.113.255), RU; Evgenii M., INETTECH-MNT, IPMAGNAT-MNT. | — | — | Context |
| RIPEstat | Announced in 89.23.113.0/24 by AS207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC). | — | — | Context |
 GreyNoise | No record. | — | — | No record |
 Shodan | No record. | — | — | No record |
 AlienVault OTX | No record. | — | — | No record |
 AbuseIPDB | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
| VPN ranges | No record. | — | — | No record |
 CrowdSec | No record. | — | — | No record |
 Spamhaus DROP | No record. | — | — | No record |
| Reverse DNS (ip.thc.org) | No record. | — | — | No record |
| DShield | Not among the 1,000 IPs most reported by DShield sensors today. | — | — | No record |
Engine rules applied
- THREATFOX_MATCHThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITYStrongest malicious evidence is 30 days old or less.
- SINGLE_SOURCE_ONLYOnly one source family provides malicious evidence.
Analyst summary
Consistent with engineMalicious, medium confidence. Listed as botnet_cc for Potassium at 100% confidence, today. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for Potassium at 100% confidence, today.
Only one source family reports malicious activity.
Attribution
Links the indicator to Potassium activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 89.23.113.104
- ASN
- AS207713
- Holder
- GIR-AS GLOBAL INTERNET SOLUTIONS LLC
- Country
- Russia (RU)
- Network
- INETTECH
- Prefix
- 89.23.113.0/24
- Open ports
- None recorded
- Tor exit
- No
- First seen
- 2026-10-03 (0 days before · ThreatFox)
- Last seen
- 2026-10-03 (0 days before)
By source
RDAPRIPEstatAnnounced in 89.23.113.0/24 by AS207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC).
- ASN
- 207713
- Holder
- GIR-AS GLOBAL INTERNET SOLUTIONS LLC
- Prefix
- 89.23.113.0/24
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
Links the indicator to Potassium activity; this does not identify a specific threat actor or implicate the hosting provider.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-10-03VirusTotal: No vendor flags it (0 of 91)
- 2026-10-03ThreatFox: Listed as botnet_cc for Potassium at 100% confidence, today
- 2026-10-03Investigated
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 89.23.113.104:15987 in the last 30 days.
- pivotPassive DNS: domains that resolved to 89.23.113.104.
- blockBlock 89.23.113.104 at the perimeter.
- enrichCheck other addresses in 89.23.113.0/24 against threat feeds.
Pivot to other tools
Opens the indicator in the source's own site (new tab).