The scan of 2ip.ru on 21 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with 2ip.ru?

5 analysed samples communicate with this URL.

How was 2ip.ru checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

2ip.ru - URL scan, 21 Aug 2026

MalwareAnalyzer by Cyble scanned 2ip.ru and returned a unknown verdict (score -12). The page resolved to 188.40.167.82 on Barzmann Internet Solutions GmbH in DE. 1 domain and 1 IP were contacted. 5 malware samples communicate with this URL. This is a point-in-time observation from 21 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -12) · Confidence 15%
Scanned URL: https://2ip.ru/
Domain: 2ip.ru · IP: 188.40.167.82 · AS24940 · DE
Server: 2ip
Page title: 2ip loading...
HTTP status: 503 · text/html
TLS issuer: C=US, O=Let's Encrypt, CN=YE1 · valid to Nov 5 18: · subject CN=2ip.ru
Scan tier: fast · observed 2026-08-21 14:02:18 UTC

Malware communicating with this URL (5)

These samples were observed contacting or being served from 2ip.ru. Each links to its full analysis.

7e3478b7fdf196da956320cd9535947d66ea606b6a15bd2d388b4966a3ce7335 - referenced · 7e3478b7fdf196da956320cd9535947d · first seen 2026-08-21
421bc4d1dff7fb5999a671dd7f77703ef36f2b2a4c1a0bf8eb56126a2f50224f - referenced · 421bc4d1dff7fb5999a671dd7f77703e · first seen 2026-08-21
bd83cffdb5446f38b8057627972749c7761da701db16c446f4afa6447bd154b3 - referenced · bd83cffdb5446f38b8057627972749c7 · first seen 2026-08-20
9a4c1b81ee5d922dff123ac7d1d6f4f23e45c7c526369d282670cbec8bd82c1f - referenced · 9a4c1b81ee5d922dff123ac7d1d6f4f2 · first seen 2026-08-13
3d62a62f96d4ddd43de424b57c31d41543a3e79acc448ca27ad0eca0a64100e9 - referenced · 3d62a62f96d4ddd43de424b57c31d415 · first seen 2026-08-12

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post

Contacted infrastructure

188.40.167.82 - AS24940 Barzmann Internet Solutions GmbH (Germany)

Observed indicators

2ip.ru
188.40.167.82
https://2ip.ru/

Other scans of 2ip.ru (5)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

21 Aug 2026 - unknown
21 Aug 2026 - unknown
20 Aug 2026 - unknown
13 Aug 2026 - unknown
12 Aug 2026 - unknown

Questions about 2ip.ru

Is 2ip.ru safe?: The scan of 2ip.ru on 21 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with 2ip.ru?: 5 analysed samples communicate with this URL.
How was 2ip.ru checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of 2ip.ru

Scanned on MalwareAnalyzer by Cyble · Open interactive scan