Confidence Level

91%

Very High?

Geolocation

🇫🇮

FinlandHelsinki

ISPCgi Global Limited

ASNAS56594

Activity Timeline

First seenFeb 21, 2026, 10:48 PM

Last seen10d ago

19Sessions

19Events

Protocol Breakdown

SSH

7 / 7

HTTP

6 / 6

TELNET

5 / 5

DOCKER

1 / 1

31.58.137.200 has a very high threat confidence level of 91%, originating from Helsinki, Finland, on the Cgi Global Limited network (56594). It has been observed across 19 sessions targeting SSH, HTTP, TELNET, DOCKER, with detected attack patterns including http mass web rce exploitation scanning, First observed on February 21, 2026, most recently active February 27, 2026.

Behaviors

Classified behavioral patterns observed

Http Mass Web Rce Exploitation Scanning

high5x

Coordinated automated exploitation attempts targeting public-facing web services, including PHPUnit eval-stdin access, PHP-CGI argument injection, Docker API exposure, directory traversal, ThinkPHP invokeFunction abuse, and command execution patterns (wget/curl pipe to shell). Identifies opportunistic bot-driven RCE scanning and framework-specific exploit chaining against internet-exposed applications.

Primitives

Individual actions observed

Http Method Get210 Http Php Echo Md5 Hello Phpunit Marker185 Http Body Wget Curl Pipe To Sh Selfrep10 Http Thinkphp Invokefunction Call User Func Array Md510 Http Php Shell Exec Base64 Decode Cve 2024 4577 Attempt10 Http Php Cgi Allow Url Include Auto Prepend Input Injection10 Telnet Echo Hex Escape Sequence Output6 Http Cgi Bin Direct Bin Sh Access5 Http Phpunit Eval Stdin Php Path Access5 Http Phpunit License Eval Stdin Path Probe5 Http Docker Api Containers Json Path Access5 Http Phpunit Util Php Eval Stdin Path Access5 Http Root Phpunit Src Eval Stdin Path Access5 Http Root Phpunit Util Eval Stdin Path Access5 Http Double Vendor Phpunit Eval Stdin Path Probe5 Http Phpunit Src Util Php Eval Stdin Path Access5 Http Root Phpunit Util Php Eval Stdin Path Access5 Http Lang Parameter Deep Path Traversal Tmp Index15 Http Pearcmd Config Create Path Traversal Md5 Write5 Http Phpunit Legacy Util Php Eval Stdin Path Access5

Related Threats

Explore related threat intelligence

🇫🇮More threats fromFinland ASMore threats fromCgi Global Limited SSHMore threats targetingSSH HTTPMore threats targetingHTTP TELNETMore threats targetingTELNET DOCKERMore threats targetingDOCKER { }Browse allAttack Patterns

WHOIS Lookup

IP Address	Confidence	Events
31.59.114.211	94%	288
31.58.137.104	75%	8

IP Address	Confidence	Events
46.62.254.170	50%	32
89.167.4.130	55%	206
65.109.101.175	75%	2
172.64.223.41	3%	1
89.167.102.3	23%	1