IPMediumSignal 63/100
82.200.154.210
Location
KazakhstanAlmaty, Almaty
ASN
AS9198
Bars
First Seen
May 12, 2023
Last Seen
Jun 10, 2026
Found in 21 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
63%
Signal Score
63 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryKazakhstan
KazakhstanRegionAlmaty, Almaty
ASNAS9198
OrganizationBars
Feed Intelligence Summary
21 reports63% confidence
21
Source reports
63%
Confidence score
Category tags
a5 httpsa6 httpsabuseabuseipdbaccess controlaccount compromiseactive scanactive scanningadbhoney honeypotaerospace & defenseapacheapache attackeraptasiaattackattacker ipsattempted exploitationaustraliaauthentication abuseauthentication attacksauthentication attemptsauto-generated securityautomated attacksautomotive manufacturingbackdoorbad reputationbad web botblacklist candidateblacklisted ipblog spambotnetbotnet activitybrute forcebrute force attackbrute force attackerbrute force attacksbrute force attemptsbrute-forcebruteforcec&c communicationc2c2 communicationc2 servercisco devicecisco device targetingcisco exploitationcisco exploitation attemptscivil servicescloud infrastructurecloud infrastructure attackcloud servicescommand & controlcommand and controlcommand injectioncommunication protocolcompromise assessmentcompromise attemptcompromised credentialscompromised hostcompromised hostsconpot attackconpot honeypotcowriecowrie activitycowrie capturecowrie detectioncowrie honeypotcowrie interactionscredential accesscredential attackcredential harvestingcredential stuffingdata encryptiondata exfiltrationdata store exposuredata theftdatabase securityddosddos attackddos attacksdecoy systemdefensedefense contractingdefense logisticsdefense systemsdefense technologydenial of servicedevice managementdigital oceandionaeadionaea activitydionaea capturedionaea detectiondionaea honeypotdionaea interactionsdionaea payloadsdistributed attacksdnsdns attackelasticpot honeypotelasticsearch monitoringelectronics manufacturingencryptionenterprise networkingenumerationeuropeexploitexploit attemptexploit attemptsexploit kit activityexploit probingexploitation activityexploitation attemptexploitation attemptsexploitation of privilegeexploited hostexternal threatextortionfailed login attemptsfattfatt analysisfatt detectionsfilefinlandfirewall logs analysisfranceftpftp attacksftp brute forceftp scangermanygovernment technologyhackinghashhoneynet connecthoneytrap activityhoneytrap eventshoneytrap honeypothttp attackhttp brute forcehttp exploitationhttp scannerics securityidentity & access exploitationindicatorindustrial automationindustrial control systemsindustrial iotindustrial productioninfrastructure acquisitionreconnaissanceingress tool transferinitial accessinjection activityinjection attacksinternet of thingsinternet-facingintrusion detectioninvalid loginiociot botnetiot securityiot targetediot/ics attackkazakhstankeyloggerlamplamp attackslamp exploit attemptslamp exploitationlamp exploitation attemptslamp stack attackslamp stack exploitationlamp vulnerability scanlateral movementlogin attemptmailoney activitymailoney eventsmailoney honeypotmalicious activitymalicious activity detectedmalicious filemalicious ip addressesmalicious linksmalicious login attemptsmalicious softwaremalicious software detectionmalicious trafficmalwaremalware behaviourmalware capturemalware deliverymalware delivery attemptmalware distributionmalware downloadmalware propagationmanualmanufacturing technologymelbourne regionmilitary operationsmirai botnetmssqlmssql brute forcenational securitynetworknetwork attacksnetwork infrastructurenetwork intrusionnetwork intrusion attemptnetwork intrusion attemptsnetwork probenetwork probingnetwork protocolnetwork reconnaissancenetwork scannetwork scanningnetwork securitynetwork service scanningnetwork traffic analysisnextraynorth americaobjectoceaniap0fp0f signaturespassword attackpassword attacksphishingphishing attackphishing trapping of deathpolandportscanpossible malware propagationpotential compromisepotential credential compromisepotential credential theftpotential malware deliveryprocess injectionprocess manufacturingprotocol exploitationpublic administrationpublic infrastructurepublic policyquality controlransomwarereconnaissanceredis honeypotregulatory agenciesremote accessremote access attacksremote service exploitationremote servicesresearchedresource hijackingrootkitrtbhscanscannerscannersscanning activityscripting attackssecurity operationssecurity policysensor-taggedsentrypeer activitysentrypeer botnetsentrypeer eventsservice enumerationservice scansftp access attemptssftp attacksftp attackssftp attemptsftp exploitation attemptsftp probingshell access attemptssip attackssip brute forcesip scansip scanningsmb brute forcesmb exploitationsmtpsmtp attackssmtp brute forcesocial engineeringsoftware exploitationspamspam distributionsql injectionsql serverssh attackssh attacksssh monitoringssh scansupply chain attacksupply chain managementsuricata alertssystem disruptiont-pott1001t1001.001t1001.002t1001.003t1005t1016t1016.001t1018t1021t1021.001t1021.002t1021.004t1027t1040t1041t1046t1053t1055t1059t1059.003t1059.004t1059.005t1059.007t1068t1071t1071.001t1071.004t1076t1077t1078t1078.002t1078.003t1078.004t1083t1087t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1187t1189t1190t1199t1203t1204t1204.001t1204.002t1210t1486t1490t1496t1497t1499.001t1499.002t1499.003t1550.003t1562t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1573t1573.001t1573.002t1583t1587.001t1589t1589.002t1590t1590.001t1592t1593t1595t1595.001t1595.002t1595.003tannertanner activitytanner eventstanner interactionstargeting databasetcp protocoltcp scantelecommunicationstelnet threatthreat actorthreat detectionthreat intelligencethreat preventiontor nodetpottrojan malwareudp port scanudp scanunauthorized accessunauthorized access attemptunauthorized access attemptsunited statesunusual network trafficuser agentvoipvoip attackvulnerability scanvultrvultr infrastructure targetedweb app attackweb application attackweb application attacksweb attackweb exploitationweb securityweb shell uploadsweb spamweb trafficworm
Activity Timeline
Jun 10Jun 10
Threat Activity Heatmap
LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
63
SIGNAL
Signal Score
63%
Confidence
21
Reports
First seenMay 12, 2023
Last seenJun 10, 2026
GeolocationKZ
CountryKazakhstan
LocationAlmaty, Almaty
ASNAS9198
OrgBars
Coords43.2525, 76.9115
VirusTotal
Not checked
WHOIS
- description
- IPv4 hosts detected attempting to brute force MSSQL on DigitalOcean Toronto (CA) honeypot
- raw
- inetnum: 82.200.154.208 - 82.200.154.211 netname: BARS descr: Almaty country: KZ admin-c: IA6940-RIPE tech-c: IA6940-RIPE status: ASSIGNED PA mnt-by: KNIC-MNT created: 2023-02-27T06:03:28Z last-modified: 2023-02-27T06:03:28Z source: RIPE person: Itbalakova Ainur address: Almaty Raiymbeka 184 address: KZ phone: +7 7019813344 nic-hdl: IA6940-RIPE mnt-by: KNIC-MNT created: 2023-02-27T06:03:28Z last-modified: 2023-02-27T06:03:28Z source: RIPE route: 82.200.128.0/19 descr: Kazakhtelecom Data Network Administration origin: AS9198 mnt-by: KNIC-MNT created: 2004-01-30T05:27:58Z last-modified: 2004-01-30T05:27:58Z source: RIPE
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 3 years ago · Last seen today
Appeared in 21 threat reports