🇰🇿 Kazakhstan: live cyber threat activity

Malicious IPs, malware and ransomware victims in Kazakhstan.

114Malicious IPs listed#43 of 182 countries · 0.17% of the world
17New in the last 24hfirst seen by any feed
24Reported by 2+ feedsindependent sources agree
1Ransomware victimsposted in the last 30 days

View Kazakhstan on the live map →All listed IPs in KazakhstanRansomware victims in Kazakhstan

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C24
  2. Malware50
  3. Phishing0
  4. Attacker60

By state or region

  1. Almaty63
  2. Astana12
  3. Karaganda7
  4. Kostanay6
  5. North Kazakhstan4
  6. Shymkent3
  7. Mangystau3
  8. East Kazakhstan3
  9. Atyraū2
  10. Aqmola2
  11. Almaty Oblysy2
  12. Qostanay2
  13. Zhetysu Region1
  14. Qyzylorda1
  15. Zhambyl1

By city

  1. Almaty65
  2. Astana12
  3. Rudnyy7
  4. Karaganda5
  5. Shymkent3
  6. Aktau3
  7. Būlaevo2
  8. Aksuat2
  9. Atyrau2
  10. Kokshetau2
  11. Kostanay1
  12. Taldykorgan1
  13. Kyzylorda1
  14. Ömirzaq1
  15. Taraz1

Networks hosting the most

NetworkIPs
AS9198 JSC Kazakhtelecom 49
AS200590 NLS Kazakhstan LLC 8
AS57013 Eurasia-Star LLP 7
AS21299 Kar-Tel LLC 6
AS210328 AO ALMAZ 6
AS41798 JSC Transtelecom 4
AS48716 PS Internet Company LLP 3
AS210006 Shereverov Marat Ahmedovich 2
AS48096 Enterprise Cloud Ltd. 2
AS60757 Optinet LLP 2
AS61367 TOO "B-TEL" 2
AS202958 LLP "Kompaniya Hoster.KZ" 2
AS205431 HostLab LLC 2
AS35104 Jusan Mobile JSC 2
AS8200 Uplink LLC 1

Malware families served from Kazakhstan

  1. Phorpiex18
  2. Gandcrab13
  3. Tiny1
  4. Evilginx1
  5. Grenam1
  6. Shortcut1
  7. AdaptixC21

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
185.229.120[.]185AttackerAttacking hostAktau, MangystauAS48503 Mobile Telecom-Service LLP1 feed2026-10-12 08:20
5.34.126[.]34AttackerAttacking hostAlmaty, Almaty OblysyAS21299 Kar-Tel LLC1 feed2026-10-12 08:10
2.134.48[.]93MalwareGrenamAtyrau, AtyraūAS9198 JSC Kazakhtelecom1 feed · 5 sandbox samples2026-10-12 07:26
199.189.248[.]96MalwareContacted by malwareAlmaty, AlmatyAS205431 HostLab LLC1 feed · 75 sandbox samples2026-10-12 06:58
89.218.133[.]68MalwarePhorpiexAlmaty, AlmatyAS9198 JSC Kazakhtelecom1 feed · 7 sandbox samples2026-10-12 06:58
89.218.194[.]74MalwarePhorpiexAstana, AstanaAS9198 JSC Kazakhtelecom1 feed · 14 sandbox samples2026-10-12 06:58
89.218.234[.]114MalwarePhorpiexAstana, AstanaAS9198 JSC Kazakhtelecom1 feed · 21 sandbox samples2026-10-12 06:58
95.59.233[.]206MalwarePhorpiexAlmaty, AlmatyAS9198 JSC Kazakhtelecom1 feed · 21 sandbox samples2026-10-12 06:58
178.89.87[.]208AttackerAttacking hostAlmaty, AlmatyAS9198 JSC Kazakhtelecom1 feed2026-10-12 06:41
89.207.249[.]14AttackerAttacking hostAlmaty, AlmatyAS202958 LLP "Kompaniya Hoster.KZ"1 feed2026-10-12 05:35
149.33.35[.]234AttackerAttacking hostAlmaty, AlmatyAS58061 Scalaxy B.V.2 feeds2026-10-12 04:35
206.223.248[.]248AttackerMalicious IPAlmaty, AlmatyAS205431 HostLab LLC1 feed2026-10-12 04:35
95.58.43[.]193AttackerMalicious IPAktau, MangystauAS9198 JSC Kazakhtelecom1 feed2026-10-12 04:35
95.58.7[.]154AttackerAttacking hostAstana, AstanaAS9198 JSC Kazakhtelecom2 feeds · 1 sandbox sample2026-10-12 04:35
77.240.38[.]12MalwareMalicious URLAlmaty, AlmatyAS48716 PS Internet Company LLPaggregated list2026-10-12 04:35
185.136.15[.]36AttackerOn multiple blocklistsAlmaty, AlmatyAS210328 AO ALMAZ1 feed2026-10-12 04:35
185.91.126[.]197AttackerAttacking hostKaraganda, KaragandaAS211971 Goodhost.KZ LLP1 feed2026-10-11 23:40
145.249.227[.]150MalwareGandcrabShymkent, ShymkentAS21299 Kar-Tel LLC1 feed · 40 sandbox samples2026-10-11 08:34
95.59.171[.]222MalwareGandcrabAlmaty, AlmatyAS9198 JSC Kazakhtelecom1 feed · 48 sandbox samples2026-10-11 08:34
178.91.91[.]13MalwareGandcrabAlmaty, AlmatyAS9198 JSC Kazakhtelecom1 feed · 11 sandbox samples2026-10-11 08:09
37.99.54[.]230MalwarePhorpiexAlmaty, AlmatyAS21299 Kar-Tel LLC1 feed · 50 sandbox samples2026-10-11 08:09
5.251.95[.]166MalwarePhorpiexKokshetau, AqmolaAS9198 JSC Kazakhtelecom1 feed · 10 sandbox samples2026-10-11 08:09
77.240.41[.]3MalwareGandcrabAktau, MangghystaūAS41371 BiKaDa TOO1 feed · 21 sandbox samples2026-10-11 08:09
88.204.242[.]226MalwarePhorpiexTimiryazevo, North KazakhstanAS9198 JSC Kazakhtelecom1 feed · 22 sandbox samples2026-10-11 08:09
89.106.236[.]58MalwarePhorpiexAlmaty, AlmatyAS9198 JSC Kazakhtelecom1 feed · 24 sandbox samples2026-10-11 08:09

See every listed IP in Kazakhstan →

Ransomware victims in Kazakhstan

1 posted in the last 30 days, 2 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-09-25 12:40taspenlife.comlockbit5Healthcare
2026-08-12 15:43SPKAA.COMclop—

All ransomware victims in Kazakhstan →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378All countries →