Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
31.57.201.154 has a threat confidence score of 95%. This IP address from The Netherlands (AS215026, Len Service SRL) has been observed in 51 honeypot sessions targeting TELNET protocols. First observed on March 26, 2026, most recently active March 26, 2026.
Telnet-based shell activity where the actor enumerates process execution context via cat /proc/self/cmdline (or equivalent) and performs directory navigation using cd. This pattern reflects post-access discovery behavior, where the session is inspecting runtime parameters and exploring filesystem layout to understand the execution environment before staging or executing additional actions. The combination indicates environmental reconnaissance rather than immediate payload deployment.