RDAPNetwork GIR_SER-NET (212.192.14.0 - 212.192.14.255), RU; Evgenii M., interlir-mnt, lir-ae-rcstechnologies-1-MNT.
- Org
- Evgenii M., interlir-mnt, lir-ae-rcstechnologies-1-MNT
- Range
- 212.192.14.0 - 212.192.14.255
- Country
- RU
- Network
- GIR_SER-NET
Verdict
MALICIOUSMedium confidence
2Supporting signals
2Independent sources
2Recent observations
82 / 100Threat score
Why the engine decided this
Deterministic engine · activity high- THREATFOX_MATCH ThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITY Strongest malicious evidence is 30 days old or less.
Key indicators
- IP address
- 212.192.14.31
- ASN
- AS207713
- Holder
- GIR-AS GLOBAL INTERNET SOLUTIONS LLC
- Country
- Russia (RU)
- Network
- GIR_SER-NET
- Prefix
- 212.192.14.0/24
- Open ports
- None recorded
- Tor exit
- No
- First seen
- 2026-09-26 (0 days before · ThreatFox)
- Last seen
- 2026-09-26 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 ThreatFox | Listed as botnet_cc for Potassium at 100% confidence, today. | 100% | 0 days recent | Strong |
 VirusTotal | 3/91 vendors (3.3%) flag it: a low detection ratio. | 3/91 | 0 days recent | Suspicious |
| RDAP | Network GIR_SER-NET (212.192.14.0 - 212.192.14.255), RU; Evgenii M., interlir-mnt, lir-ae-rcstechnologies-1-MNT. | — | — | Context |
 RIPEstat | Announced in 212.192.14.0/24 by AS207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC). | — | — | Context |
Coverage · checked, no record: Shodan, AlienVault OTX, AbuseIPDB, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list, DShield · failed: GreyNoise
Analyst summary
Consistent with engineMalicious, medium confidence. Listed as botnet_cc for Potassium at 100% confidence, today. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for Potassium at 100% confidence, today.
- [VirusTotal] 3/91 vendors (3.3%) flag it: a low detection ratio.
Lookups failed for GreyNoise: no information either way. Only one source family reports malicious activity.
Attribution
Links the indicator to Potassium activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
All evidence
13 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| ThreatFox | Listed as botnet_cc for Potassium at 100% confidence, today. | 100% | 0 days recent | Strong |
| VirusTotal | 3/91 vendors (3.3%) flag it: a low detection ratio. | 3/91 | 0 days recent | Suspicious |
| RDAP | Network GIR_SER-NET (212.192.14.0 - 212.192.14.255), RU; Evgenii M., interlir-mnt, lir-ae-rcstechnologies-1-MNT. | — | — | Context |
| RIPEstat | Announced in 212.192.14.0/24 by AS207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC). | — | — | Context |
 GreyNoise | Lookup failed: no information either way. | — | — | Failed |
 Shodan | No record. | — | — | No record |
 AlienVault OTX | No record. | — | — | No record |
 AbuseIPDB | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
| DShield | Not among the 1,000 IPs most reported by DShield sensors today. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- THREATFOX_MATCHThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITYStrongest malicious evidence is 30 days old or less.
- SINGLE_SOURCE_ONLYOnly one source family provides malicious evidence.
Analyst summary
Consistent with engineMalicious, medium confidence. Listed as botnet_cc for Potassium at 100% confidence, today. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for Potassium at 100% confidence, today.
- [VirusTotal] 3/91 vendors (3.3%) flag it: a low detection ratio.
Lookups failed for GreyNoise: no information either way. Only one source family reports malicious activity.
Attribution
Links the indicator to Potassium activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 212.192.14.31
- ASN
- AS207713
- Holder
- GIR-AS GLOBAL INTERNET SOLUTIONS LLC
- Country
- Russia (RU)
- Network
- GIR_SER-NET
- Prefix
- 212.192.14.0/24
- Open ports
- None recorded
- Tor exit
- No
- First seen
- 2026-09-26 (0 days before · ThreatFox)
- Last seen
- 2026-09-26 (0 days before)
By source
RDAPRIPEstatAnnounced in 212.192.14.0/24 by AS207713 (GIR-AS GLOBAL INTERNET SOLUTIONS LLC).
- ASN
- 207713
- Holder
- GIR-AS GLOBAL INTERNET SOLUTIONS LLC
- Prefix
- 212.192.14.0/24
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
Links the indicator to Potassium activity; this does not identify a specific threat actor or implicate the hosting provider.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-09-26VirusTotal: 3/91 vendors (3.3%) flag it: a low detection ratio
- 2026-09-26ThreatFox: Listed as botnet_cc for Potassium at 100% confidence, today
- 2026-09-26Investigated
Run history
2 collections of this indicator- 2026-09-27MALICIOUS82Live lookupsOpen · newest
- 2026-09-26MALICIOUS82Live lookupsShown
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 212.192.14.31:15987 in the last 30 days.
- pivotPassive DNS: domains that resolved to 212.192.14.31.
- blockBlock 212.192.14.31 at the perimeter.
- enrichCheck other addresses in 212.192.14.0/24 against threat feeds.
Pivot to other tools
Opens the indicator in the source's own site (new tab).