31.31.196.17 Threat Intelligence and Host Information

Aug 31, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 31.31.196.17 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 77/100

Host and Network Information

  • Mitre ATT&CK IDs: T1012 - Query Registry, T1018 - Remote System Discovery, T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1036 - Masquerading, T1045 - Software Packing, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1056 - Input Capture, T1057 - Process Discovery, T1060 - Registry Run Keys / Startup Folder, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1089 - Disabling Security Tools, T1095 - Non-Application Layer Protocol, T1096 - NTFS File Attributes, T1105 - Ingress Tool Transfer, T1112 - Modify Registry, T1119 - Automated Collection, T1129 - Shared Modules, T1497 - Virtualization/Sandbox Evasion, T1518 - Software Discovery, T1547 - Boot or Logon Autostart Execution, T1574 - Hijack Execution Flow

  • Tags: 0pgtwhu, aaaa, accept, adobe, a domains, adversaries, age86400 set, alerts, all scoreblue, all search, analysis date, analysis ob0001, analysis ob0002, april, as15169 google, as29873, as44273 host, as45102 alibaba, as46691, as4812 china, as54113, as8075, ascii text, asnone united, authentihash, av detections, bcnt1, binary file, black mercedes, body, body xml, boot, botnet, catalog tree, check registry, china, china unknown, cname, code, connection, contacted, content type, control ob0004, cookie, copy, creation date, date, default, delete, delete c, delphi, detection b0009, displayname, dll sideloading, dns resolutions, domain, dynamic, dynamic link, dynamicloader, emails, embeddedwb, encryption, entries, error code, executable code, execution, execution t1547, expiration date, fastly error, file guard, filehash, files, file samples, file score, files location, files matching, flow t1574, germany unknown, get http, gmt content, hashes, high, high process, home welcome, hostid ec, hostname, http, http requests, hx88x9ax1e, ids detections, incorporated, infection, info, injection t1055, intel, iocs, ip address, ip traffic, ipv4, javascript, jeff4son, july, june, keys, langchinese, legalcopyright, levelbluelabs, library, library exe, local, logon autostart, lowfi, magic pe32, malicious, malware, mascore2, media, medium, memory pattern, meta, mike, moved, msie, msil, ms windows, mx81xd1r, name servers, nct1, next, nxdomain, otx scoreblue, passive dns, path max, pattern domains, pdfcreator.sf.net, pe32, pe32 executable, persistence, pid425870621, please, please forgive me, port, potential scan, pulse pulses, pulse submit, push, query, ransom, read, read c, recon, record value, regbinary, registry, registry run, regsetvalueexa, related nids, related pulses, request, requestid, reserved, response, rtversion, salicode, scan endpoints, script domains, script script, script urls, sea p, search, server, servers, service, sha256, shellexecuteexw, show, showing, slot1, ssdeep, stack strings, startup folder, status, stream, suite, swipper, t1045, t1497 may, taobao network, therahand thouroughhand, tid700443057, tofsee, tools, tpid425870621, trid win32, trojan, trojanspy, type, unid88000705, unique, united, unknown, upack, url analysis, url http, url https, urls, urls http, vhash, virtual machine, whitelisted, win32, win32 exe, windows, windows nt, worm, write, write c, x84xa8xe8i, x87xe1x1d, x8dxb7xb7, x92xac, x95xd3xa4, xc2x84, yara detections, yara rule

  • JARM: 29d29d00029d29d00042d42d0000005d86ccb1a0567e012264097a0315d7a7

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: blocklist_net_ua, coinbl_ips, hphosts_emd, hphosts_exp, hphosts_fsa, hphosts_pha, hphosts_psh

Malware Detected on Host

Count: 2 812f88877f75bf1b9dbc0f807e38f9391f0610e2e3a7ffbd5ef70048b5044289 0f2720d6a546a6967200d9d79d7aaf25d733bf2860fcdddaf212a6cd290a1c61

Open Ports Detected

143 21 22 25 3306 443 465 53 587 993 995

Map

Whois Information

  • inetnum: 31.31.192.0 - 31.31.203.255
  • netname: REGRU-NETWORK
  • org: ORG-nrRL1-RIPE
  • descr: Reg.Ru Hosting
  • country: RU
  • admin-c: RGRU-RIPE
  • tech-c: RGRU-RIPE
  • mnt-domains: REGRU-MNT
  • status: ASSIGNED PA
  • mnt-by: REGRU-MNT
  • created: 2011-03-30T12:52:16Z
  • last-modified: 2014-02-18T18:07:34Z
  • mnt-routes: SKYMEDIA-MNT
  • mnt-routes: RU-ANDERS-MNT
  • mnt-routes: REGRU-MNT
  • organisation: ORG-nrRL1-RIPE
  • org-name: “Domain names registrar REG.RU”, Ltd
  • country: RU
  • org-type: LIR
  • address: LENINGRADSKY PR-KT, 72, building 3,
  • address: 125315
  • address: Moscow
  • address: RUSSIAN FEDERATION
  • phone: +74955801111
  • admin-c: RGRU-RIPE
  • mnt-ref: REGRU-MNT
  • mnt-ref: AS2118-MNT
  • mnt-ref: RIPE-NCC-HM-MNT
  • mnt-by: RIPE-NCC-HM-MNT
  • mnt-by: REGRU-MNT
  • abuse-c: RGRU-RIPE
  • created: 2011-02-21T11:14:37Z
  • last-modified: 2024-04-03T05:33:51Z
  • role: Reg.Ru Network Operations
  • address: Russia, Moscow, Vassily Petushkova st., house 3, Office 326
  • phone: +7 (495) 580-11-11
  • fax-no: +7 (495) 491-55-53
  • admin-c: ARP-RIPE
  • admin-c: MS55099-RIPE
  • tech-c: ARP-RIPE
  • tech-c: MS55099-RIPE
  • nic-hdl: RGRU-RIPE
  • mnt-by: REGRU-MNT
  • abuse-mailbox: abuse@reg.ru
  • created: 2011-03-30T12:49:27Z
  • last-modified: 2022-11-29T14:58:55Z
  • route: 31.31.196.0/24
  • descr: Reg.Ru
  • origin: AS197695
  • mnt-by: REGRU-MNT
  • created: 2014-02-23T09:39:33Z
  • last-modified: 2014-02-23T09:39:33Z

Links to attack logs

****** ****** ******

Share on: