Check an IP Address, Domain Name, Subnet, or ASN
186.116.1.219 has a threat confidence score of 96%. This IP address from Colombia (AS3816, COLOMBIA TELECOMUNICACIONES S.A. ESP BIC) has been observed in 36 honeypot sessions and reported 1 times targeting MSSQL, SMB protocols. First observed on January 21, 2026, most recently active March 28, 2026.
MSSQL session sequence performing automated server reconnaissance through multiple sp_server_info calls, case-sensitivity probing, charset and configuration enumeration from master.dbo tables, and session environment adjustments (set textsize, set arithabort on). The observed queries indicate scripted capability discovery and environment profiling based strictly on database command activity.
Identifies a coordinated Microsoft SQL Server reconnaissance sequence where the client sets session options (SET ARITHABORT ON, SET TEXTSIZE), invokes sp_server_info, performs a case-sensitivity probe, and enumerates syscharsets. This tightly grouped activity pattern reflects automated environment fingerprinting and configuration discovery typically executed immediately after successful connection to an exposed MSSQL service. The behavior is indicative of tooling-driven reconnaissance to assess server configuration, collation behavior, and encoding characteristics prior to follow-on exploitation or credential abuse.
| Reporter | Date | Category | Protocol | Comment |
|---|---|---|---|---|
| User | Mar 18, 2026, 08:08 | Brute Force | SMB | SikkerGuard: 2 blocked packets |