IOC Radar
IPMediumSignal 100/100

193.37.69.157

Location
The NetherlandsThe Netherlands
Amsterdam, North Holland
ASN
AS213194
Aliev
First Seen
Sep 12, 2024
Last Seen
Jun 6, 2026
Sep 12
First Seen
640d ago
Jun 6
Last Seen
9d ago
12
Reports
source reports
99%
Confidence
medium
1/91
VirusTotal
detections
Found in 12 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
99%
Signal Score
100 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

63 techniques

Network Information

CountryNLThe Netherlands
RegionAmsterdam, North Holland
ASNAS213194
OrganizationAliev

Feed Intelligence Summary

12 reports99% confidence
12
Source reports
99%
Confidence score
Category tags
abuseactive scanactive scanningadbhoney honeypotaerospace & defenseantispamattackaustraliaauthenticationauthentication abuseauthentication attackauthentication attemptauthentication attemptsauthentication brute forceauthentication failureauthentication logsbad reputationbankingbotnetbotnet activitybrute forcebrute force attackbrute force attacksbrute force attemptbrute force attemptsbrute_forcec2 servercisco devicecisco exploitation attemptscode executioncommand & controlcommand and controlcommand executioncommunication protocolcommunication technologiescompromised credentialscompromised hostsconpot honeypotconsumer goodscowrie activitycowrie attackscowrie honeypotcowrie interactionscredential accesscredential brute-forcingcredential harvestingcredential stuffingcredential theftcredential_accesscredit card servicescryptocurrencycryptocurrency threatscryptojackingdata exfiltrationdata exfiltration attemptsdata store exposuredata theftdatabase securityddosddos probedecoy systemdefensedefense contractingdefense evasiondefense logisticsdefense systemsdefense technologydevice managementdionaea honeypotdionaea interactionsdionaea malware analysisdistributed attackselasticpot honeypotelasticsearch monitoringenterprise networkingeuropeeurope/asiaexploitation activityexploitation attemptexploitation attemptsexploitation of vulnerabilityfattfinancefinancial servicesfinancial technologyfraudftpftp attackftp brute forceftp_bruteforceheralding activityheralding attack patternhoneytrap honeypothttp attackhttp scannerhttp_scanhttpshttps_scanics securityidentity & access exploitationindicatorindustrial control systemsinformation technologyinitial accessinjection activityinjection attacksiociot securityiot targetediot/ics attackipqsit infrastructurelamplamp stack targetinglateral movementlog4jmailoney honeypotmalicious activitymalicious payload detectionmalicious softwaremalwaremalware behaviourmalware capturemalware deployment attemptsmalware detectionmalware distributionmediamilitary operationsmobile carriersmobile networksnational securitynetherlandsnetworknetwork enumerationnetwork infrastructurenetwork intrusionnetwork intrusion attemptnetwork intrusion attemptsnetwork probenetwork probingnetwork reconnaissancenetwork scannetwork scanningnetwork securitynetwork service protocolnetwork service scanningnetwork traffic analysisnlnorth americaoceaniap0fpassword attackpassword attackspassword crackingpayment processingphishingphishing attackphishing trappossible botnet activityprocess injectionprotocol exploitationpython script activityransomwarereconnaissanceremote accessremote access softwareremote desktopremote servicesremote_accessresearchedresource hijackingretail traderfbrussiarussian federationscams & fraudscannerscanning activityscripting attackssensor-taggedsentrypeer botnetservice scansftp access attemptsftp attackshell access attemptssingle source ipsip attackssip brute forcesmtpsocial engineeringsoftware developmentsoftware exploitationspamsql injection attemptssh attackssh monitoringssh_bruteforcet-pott1018t1021t1021.001t1021.002t1021.004t1021.005t1027t1040t1041t1046t1048t1048.003t1053t1055t1059t1059.001t1059.003t1059.004t1059.005t1059.007t1071t1071.001t1076t1078t1078.002t1078.003t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1187t1189t1190t1199t1203t1204.002t1486t1496t1499.001t1499.002t1499.003t1550t1550.003t1555t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1567.001t1573t1583t1589t1589.002t1595t1595.001t1595.002t1595.003tannertargeting databasetelecom servicestelecommunicationstelnet threattelnet_bruteforcethreat actorthreat detectionthreat intelligencetor nodetpottpotceunauthorized access attemptunauthorized login attemptsunited statesus ip addressus sourceus source ipus_ipvalid accountsvnc authentication bypassvnc protocolvoipvoip attackvulnerability scanwealth managementweb attackweb exploitationweb traffic

Activity Timeline

1 total obs
Jun 6Jun 6

Threat Activity Heatmap

· Peak: 2026-06-06
Less
More
Mon
Wed
Fri
Jun
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreHigh Risk
100
SIGNAL
Signal Score
99%
Confidence
12
Reports
First seenSep 12, 2024
Last seenJun 6, 2026
GeolocationNL
CountryThe Netherlands
LocationAmsterdam, North Holland
ASNAS213194
OrgAliev
Coords52.3676, 4.9041

VirusTotal

1/ 91vendors flagged
1% detection rateJun 8, 2026

WHOIS

description
Observed on T-Pot within last 24h; sensors=honeytrap, p0f, suricata; threshold?1; private IPs excluded.
raw
inetnum: 193.37.69.0 - 193.37.69.255 netname: nechaev-net country: NL admin-c: AA44584-RIPE tech-c: AA44584-RIPE abuse-c: AA44566-RIPE status: ASSIGNED PA mnt-by: ru-avm-1-mnt mnt-by: nethost-mnt created: 2025-02-18T03:21:50Z last-modified: 2025-03-05T15:20:25Z source: RIPE role: abuse-c address: Russia, Barnaul abuse-mailbox: [email protected] nic-hdl: AA44584-RIPE mnt-by: nechd-mnt created: 2025-02-16T12:04:26Z last-modified: 2025-02-16T12:05:29Z source: RIPE # Filtered route: 193.37.69.0/24 origin: AS213194 mnt-by: nethost-mnt created: 2025-02-19T15:37:34Z last-modified: 2025-02-19T15:37:34Z source: RIPE
references
https://github.com/telekom-security/tpotce, https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt, https://www.ipqualityscore.com/sample-ip-blacklist.txt

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 9 days ago
Appeared in 12 threat reports