IPMediumSignal 84/100
176.32.195.85
Location
ArmeniaYerevan, Yerevan
ASN
AS197834
Interactive TV LLC
First Seen
Jun 19, 2025
Last Seen
May 28, 2026
Found in 32 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
84%
Signal Score
84 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryArmenia
ArmeniaRegionYerevan, Yerevan
ASNAS197834
OrganizationInteractive TV LLC
IP Category
⟲
Proxy
Proxy server
⊕
VPN
VPN exit node
Feed Intelligence Summary
32 reports84% confidence
32
Source reports
84%
Confidence score
Category tags
access controlaccount compromiseaccount securityaccount takeover attemptackactive reconnaissanceactive scanactive scanningadbadb attacksadb brute forceadb protocoladb_protocoladbhoney activityadbhoney attackadbhoney attacksadbhoney detectionadbhoney exploitsadbhoney honeypotadministrative accessafricaagentalertamand exploitation attemptsandroid device attacksanomalous network connectionsapacheapache exploitsapplication layer protocolaptargentinaasiaattackattack attemptattack preparatoryattack surface discoveryattack vectorsattacker hostsattacker ipattacker ipsattacker-ipaustraliaauthenticationauthentication abuseauthentication attackauthentication attacksauthentication attemptauthentication attemptsauthentication brute forceauthentication failureauthentication-attemptsauthentication_attemptauthentication_attemptsauthentication_bypassauthentication_failuresauto-blockedauto-blocked ipautomated activityautomated attackautomated attacksautomated threatautomated-attackautomated_attackbad reputationbad web botbangladeshbelgiumblacklisted ip addressblock listblock.txtblocklist_allblog spambotnetbotnet activitybrazilbrute forcebrute force attackbrute force attackerbrute force attacksbrute force attemptbrute force attemptsbrute force authenticationbrute-forcebrute-force attackbrute-force-attackbrute_forcebrute_force_attackc2c2 communicationc2 servercanadachinachina mobilecins activecisco activitycisco asacisco attackcisco brute forcecisco devicecisco device attackcisco device attackscisco device scanningcisco device targetingcisco exploitcisco exploit attemptcisco exploit attemptscisco exploitationcisco exploitation attemptcisco exploitation attemptscisco protocol attackscisco-device-targetingcisco_device_attackcloud environmentcloud infrastructurecloud infrastructure attackcloud providercloud servicecloud servicescloud_infrastructurecode executioncolumnscommand & controlcommand and controlcommand executioncommand injectioncommand injection attemptcommand injection attemptscommunication protocolcompany limitedcompromise attemptcompromised credentialscompromised hostcompromised host activitycompromised host detectioncompromised hostscompromised systemsconfig manipulationconfiguration manipulationconfiguration modificationconnected devicesconpot activityconpot attackconpot attacksconpot exploitationconpot honeypotconpot interactioncontainer securitycowrie activitycowrie attackcowrie attackscowrie capturecowrie datacowrie detectioncowrie emulationcowrie honeypotcowrie honeypot datacowrie interactioncowrie interactionscowrie logscowrie ssh attackcowrie ssh attackscowrie ssh honeypotcredential accesscredential access attemptscredential attackcredential attackscredential brute forcecredential brute forcingcredential brute-forcingcredential compromisecredential guessingcredential harvestingcredential stuffingcredential-accesscredential-guessingcredential-stuffingcredential_accesscredential_attackcredential_guessingcredential_stuffingcredentialaccesscron injectioncross-site scriptingcurlcvecve exploitationdaily_sourcesdata encryptiondata exfiltrationdata exfiltration attemptdata store exposuredata theftdatabase access attemptdatabase activitydatabase attackdatabase attacksdatabase brute forcedatabase exploitationdatabase exploitation attemptsdatabase intrusion attemptdatabase login attemptdatabase probingdatabase scandatabase scanningdatabase securitydatabase serverdatabase serversdatabase servicedatabase_serverdcerpcddosddos attackddos attack indicatorsddos attacksddos attemptddos preparationddos probeddos probingddos reflectionddospotdecoy systemdenial of servicedenial-of-servicedenial-of-service attemptdevice managementdictionary attackdictionary_attackdigital oceandigitalocean environmentdigitalocean ipdigitalocean ipsdionaea activitydionaea alertdionaea attackdionaea attacksdionaea capturedionaea detectiondionaea honeypotdionaea interactionsdionaea malware collectiondionaea malware detectiondionaea malware samplesdionaea payloadsdirectory traversaldirectory traversal attemptdistributed attacksdnsdns attackdockerdshield blockdugganusa threat intelligenceelasticpot activityelasticpot honeypotelasticsearchelasticsearch monitoringencryptionenterprise networkingenumerationet dropeu cyber policieseuropeeurope/asiaexecutable fileexfiltrationexploitexploit activityexploit attemptexploit attemptsexploit kit activityexploit probingexploit targetingexploitationexploitation activityexploitation attemptexploitation attemptsexploitation of privilegeexploitation of vulnerabilityexploitation_attemptexploited hostexploitsexport-to-otxexternal access attemptsexternal threatexternal-scanningexternal-threatexternal_threatextortionfailed authenticationfailed loginfailed login attemptsfattfatt analysisfatt detectionsfatt signaturesfilefinlandfrancefraud voipftpftp activityftp attackftp attacksftp brute forceftp brute-forceftp scanftp_protocolgalahgeneric exploitgermanyget requestgluttongopothackinghellpotheralding activityheralding behaviorhk abusehandlerhoneynet connecthoneypot 24h activityhoneytrap activityhoneytrap datahoneytrap eventshoneytrap exploit attemptshoneytrap honeypothoneytrap interactionshong konghttp attackhttp brute forcehttp exploitationhttp probinghttp request anomalieshttp request smugglinghttp scannerhttp scanninghttp/shttp_protocolhttpshttps probinghurricane usicmpics attacksics securityics/scadaics/scada attackics/scada attacksics/scada protocolsics/scada systemsidentity & access exploitationimapimap attackindiaindicatorindicators of compromiseindustrial control systemsindustrial iotinformation gatheringinformation technologyinfrastructure acquisitionreconnaissanceinfrastructure reconnaissanceinfrastructure scanninginfrastructure targetinginitial accessinitial access attemptinitial access vectorinitial_accessinitial_access_attemptinjection activityinjection attacksinput validation bypassinternet facinginternet facing systemsinternet of thingsinternet-facinginternet-facing assetsinternet-facing serviceinternet-wide scaninternet_scannersintrusion detectioninvalid credentialsinvalid loginiociocsiot analyticsiot applicationsiot attacksiot botnetiot device attacksiot device targetingiot platformsiot securityiot systemsiot targetediot/ics attackiot_attackip-addressesipp_protocolipphoney activityipphoney honeypotipv4ipv4 activityipv4 addressesipv4 attacksipv4 port scanningipv4 scanningipv4 threatsipv4-iocipv4_activityipv4_addressiraqirelandit infrastructureitalyjapankenyakibanakorea, republic oflamplamp activitylamp attacklamp exploitlamp exploit attemptlamp exploit attemptslamp exploitationlamp exploitation attemptlamp exploitation attemptslamp server attacklamp server targetinglamp stacklamp stack attacklamp stack attackslamp stack exploitationlamp stack targetedlamp stack targetinglamp vulnerability exploitationlamp vulnerability scanlamp_stack_attacklateral movementlateral movement attemptlcialinuxlinux serverslinux system targetinglinux systemslinux-server-attacklinux-server-attackslinux-server-targetinglinux_server_attackslisted sourcelithuanialocal file inclusionlog4potlog4shellloginlogin attacklogin attemptlogin attemptslogin brute forcelogin failureloginattackmail protocol abusemailoney activitymailoney attackmailoney attacksmailoney detectionmailoney eventsmailoney honeypotmailoney interactionsmalaysiamalicious activitymalicious activity detectedmalicious code detectionmalicious emailmalicious email activitymalicious email detectionmalicious file transfermalicious ip activitymalicious ip blockedmalicious ip listmalicious ipsmalicious ipv4malicious loginmalicious login attemptsmalicious network activitymalicious payloadmalicious payload attemptsmalicious payload detectionmalicious script executionmalicious sftp activitymalicious softwaremalicious software detectionmalicious software targetingmalicious ssh activitymalicious trafficmalicious-activitymalicious-login-attemptsmalwaremalware activitymalware analysismalware behaviourmalware capturemalware deliverymalware delivery attemptmalware delivery attemptsmalware distributionmalware downloadmalware download attemptsmalware installationmalware probingmalware propagationmalware propagation attemptmalware_activitymalware_distribution_attemptmedpotmelbourne regionmexicomirai botnetmispmobile threatmodbusmodbus protocolmodule loadingmoroccomssqlmssql brute forcemulti-protocol network scanningmultiple port scanmysql brute forcenetherlandsnetworknetwork activitynetwork attacksnetwork device attacksnetwork device probingnetwork devicesnetwork discoverynetwork enumerationnetwork exploitationnetwork infrastructurenetwork intrusionnetwork intrusion attemptnetwork intrusion attemptsnetwork intrusion detectionnetwork probenetwork probingnetwork protocolnetwork reconnetwork reconnaissancenetwork reconnaissance activitynetwork scannetwork scanningnetwork scanning activitynetwork securitynetwork service discoverynetwork service scanningnetwork servicesnetwork traffic analysisnetwork-based attack attemptsnetwork-devicesnetwork-discoverynetwork-reconnaissancenetwork-scanningnetwork-service-attacknetwork_attacknetwork_discoverynetwork_enumerationnetwork_intrusion_attemptnetwork_reconnaissancenetwork_scannetwork_scanningnetwork_service_exploitationnetworkscanningnew zealandnorth americanull scanoceaniaopen port detectionopen proxyopenctioperating systemoperating system securityopportunistic attackopportunistic attackeropportunistic attacksosint enrichmentot attacksoutbound communication blockingp0fp0f fingerprintingp0f network fingerprintingp0f os fingerprintingp0f passive fingerprintingp0f signaturespassword attackpassword attackspassword crackingpassword sprayingpassword-guessingpassword_attackpassword_guessingpath traversalpath traversal attemptsperimeter securitypgp signphishingphishing attackphishing trappingping of deathpolandpoor reputationportport-scanningpossible botnet activitypossible credential reusepossible exploit attemptspossible malware deploymentpossible malware distributionpossible malware infectionpossible malware propagationpossible mirai variantpossible reconnaissancepossible reconnaissance activitypost requestpotential botnetpotential botnet activitypotential compromisepotential credential compromisepotential credential theftpotential data exfiltrationpotential intrusionpotential intrusion attemptpotential malicious activitypotential malware activitypotential malware deliverypotential malware distributionpotential malware uploadpotential reconnaissancepotential reconnaissance activitypotential vulnerability exploitationpotential vulnerability probingpotential vulnerability scanprivilege escalationprocess injectionprotoprotocol abuseprotocol exploitationprotocol-abuseproxyproxy accesspublic-facing applicationpublicly accessible infrastructureransomwareransomware activityrcerdp attacksrdp protocolrdp scanningreconnaissancereconnaissance activityreconnaissance-activitiesredis attacksredis exploitationredis exploitation attemptsredis honeypotredis protocolredishoneypot activityregional securityremote accessremote access attackremote access attacksremote access attemptremote access attemptsremote code executionremote file inclusionremote loginremote service exploitationremote servicesremote-accessremote_accessremote_access_servicereplication attackresearchedresource developmentresource hijackingrussias7comms7comm protocolscams & fraudscanscannerscanner ipscanner ipsscannersscanning activityscripting attackssecurity eventsecurity operationssecurity policysensor-taggedsentrypeer activitysentrypeer botnetsentrypeer detectionsentrypeer eventssentrypeer interactionssentrypeer sip attackssentrypeer targetedserver exploitationserver securityservice discoveryservice enumerationservice probingservice scanservice scanningsftp access attemptsftp access attemptssftp activitysftp attacksftp attackssftp attemptsftp attemptssftp exploitationsftp exploitation attemptsftp exploitation attemptssftp protocolsftp scanningsftp-attacksftp-brute-forcesftp_protocolshellshell accessshell access attemptsingaporesip activitysip attackssip brute forcesip probingsip protocolsip scansip scanningsip vulnerability probingsip vulnerability scansip-scanningsip_protocolsippslaveofsmart devicessmb attackssmb brute forcesmb exploitationsmb scanningsmb_protocolsmtpsmtp attacksmtp attackersmtp attackssmtp brute forcesmtp enumerationsmtp probingsmtp scanningsmtp traffic analysissmtp_protocolsnaresocial engineeringsoftware developmentsoftware exploitationsouth africasouth americaspamsql brute forcesql injectionsql injection attemptsql injection attemptsssh activityssh attackssh attacksssh bruteforcessh key injectionssh monitoringssh protocolssh-brute-forcessh_protocolssl certificate validationssl-enrichmentsuricata alertsuricata alertsswedensynsyn port scansyn scansyn scanningsystem accesssystem discoverysystem disruptiont-pott1005t1016t1018t1020t1021t1021.001t1021.002t1021.003t1021.004t1021.005t1021.006t1027t1033t1040t1041t1046t1047t1048t1053t1053.005t1055t1056t1057t1059t1059.001t1059.003t1059.004t1059.005t1059.007t1065t1068t1069.001t1070.004t1071t1071.001t1071.004t1072t1076t1077t1078t1078.001t1078.002t1078.003t1078.004t1082t1083t1087t1088t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1136.001t1187t1189t1190t1192t1195t1199t1203t1204t1204.002t1210t1213t1486t1490t1496t1497t1499.001t1499.002t1499.003t1505t1505.002t1505.003t1505.004t1547t1550t1550.002t1550.003t1552.001t1555t1559t1562t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1572t1573t1573.001t1573.002t1574.001t1583t1587.001t1588t1588.002t1588.004t1588.006t1589t1589.002t1590t1590.001t1590.003t1590.004t1590.005t1590.006t1592t1592.002t1595t1595.001t1595.002t1595.003taiwantannertanner activitytanner attacktanner attackstanner detectiontanner eventstanner exploitstanner interactionstargeted service attacktargeting databasetcp protocoltcp scantcp scanningtcp-scanningtelecommunicationstelnet attackstelnet scanningtelnet threattelnet-brute-forcetelnet_protocolthreat actorthreat actor activitythreat actor: unknownthreat detectionthreat feedthreat intelligencethreat intelligence feedthreat preventionthreat-intelthreat-intelligencethreat_intelligencetimeouttop10.txttopips.txttor nodetorontotpottpotcettpsudp port scanudp scanudp-scanningukraineunattributed activityunattributed threat actorunauthorized accessunauthorized access attemptunauthorized access attemptsunauthorized activityunauthorized authenticationunauthorized loginunauthorized login attemptunauthorized login attemptsunauthorized probingunauthorized-access-attemptunidentified threat actorunited kingdomunited statesunknown threat actorunsolicited trafficus abuseus ip addressus noneus sourceus source ipus_origin_sourceuser executionuzbekistanvalid accountsvenezuela, bolivarian republic ofvnc protocolvoidtrapvoipvoip attackvoip attacksvoip systemsvpnvpn ipvulnerabilityvulnerability scanvulnerability-scanningvultr cloud infrastructurevultr infrastructure targetedvultr-platformvultr_platform_activityweb app attackweb applicationweb application attackweb application attacksweb application exploitationweb application scanweb application scanningweb attackweb attacksweb brute forceweb exploit attemptweb exploitationweb login attemptweb serverweb server attackweb server attacksweb server probingweb serversweb service scanningweb shellweb shell attemptweb shell detectionweb shell uploadweb shell uploadsweb spamweb trafficweb-application-attackweb-application-attacksweb-serversweb_application_attackweb_attackweb_serverwgetwindows system targetingwordpotxmas scan
Activity Timeline
May 28May 28
Threat Activity Heatmap
· Peak: 2026-05-28LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Intelligence SummaryAI Generated
This Indicator of Compromise (IOC), an IPv4 address, is of critical importance due to its high threat score of 84.14 and its association with various malicious activities. Its presence in an organization's environment suggests potential compromise or active targeting by threat actors. The associated threats include the deployment of trojans and cryptocurrency miners, which can lead to system hijacking, resource abuse, and potentially further malicious actions like data exfiltration or denial-of-…
Threat ScoreHigh Risk
84
SIGNAL
Signal Score
84%
Confidence
32
Reports
First seenJun 19, 2025
Last seenMay 28, 2026
GeolocationAM
CountryArmenia
LocationYerevan, Yerevan
ASNAS197834
OrgInteractive TV LLC
Coords40.0008, 44.9987
ProxyVPN
VirusTotal
Not checked
WHOIS
- description
- Score: 100/100 | Detector: threat_feed | Label: reported_abuse | Tags: reported_abuse, abuseipdb
- raw
- inetnum: 176.32.192.0 - 176.32.195.255 netname: INTERTV-NET descr: Interactive TV LLC country: AM org: ORG-ITL23-RIPE admin-c: AH4519-RIPE tech-c: AH4519-RIPE status: ASSIGNED PA mnt-by: MNT-AH4519 mnt-lower: MNT-AH4519 mnt-routes: MNT-AH4519 created: 2011-11-23T08:04:26Z last-modified: 2011-11-23T08:05:58Z source: RIPE # Filtered organisation: ORG-ITL23-RIPE org-name: Interactive TV LLC org-type: OTHER address: Komitas Str., 34, bldg. 55 address: 0012 address: Yerevan address: ARMENIA phone: +37496010696 fax-no: +37410229970 admin-c: AH4519-RIPE tech-c: AH4519-RIPE abuse-c: IA3265-RIPE mnt-ref: MNT-AH4519 mnt-by: MNT-AH4519 created: 2011-05-13T12:23:14Z last-modified: 2018-09-21T06:45:55Z source: RIPE # Filtered person: Ashot Hakobyan address: Saryan26/4 phone: +374-91-3112561 nic-hdl: AH4519-RIPE mnt-by: MNT-AH4519 created: 2009-01-09T13:59:21Z last-modified: 2013-01-23T09:10:31Z source: RIPE route: 176.32.194.0/23 descr: Interactive TV LLC descr: iTV route for 194.0/23 net origin: AS197834 mnt-by: MNT-AH4519 created: 2012-01-17T09:45:42Z last-modified: 2012-01-18T07:46:22Z source: RIPE
- references
- https://github.com/telekom-security/tpotce
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 11 months ago · Last seen 15 days ago
Appeared in 32 threat reports