A custom Prometheus-backed infrastructure-monitoring platform (MySQL schema dumped from source "nz-prometheus", schema "nz-temp", dated 2020-10-16) has its sys_area reference table seeded with exactly the five Kazakhstan cities named in the K18 site-codename entry — Aktau, Almaty, Nur-Sultan (the pre-2022 name for Astana), Karaganda, and Zhezkazgan — and a companion live alert-message dump (dated Nov 2020) shows real "endpoint down" P2 alerts tagged Data center: Nur-Sultan / Aktau, Project: ADC, across modules named MXN-NODE and MCN0-3-NODE/SRV, pushing the earliest confirmed evidence of the K18 Kazakhstan deployment back to at least October-November 2020.
INSERT INTO `sys_area` VALUES (1, 'Aktau', ...); INSERT INTO `sys_area` VALUES (3, 'Almaty', ...); INSERT INTO `sys_area` VALUES (4, 'Nur-Sultan', ...); INSERT INTO `sys_area` VALUES (6, 'Karaganda', ...); INSERT INTO `sys_area` VALUES (18, 'Zhezkazgan', ...) ... 'Data center: Nur-Sultan' ... 'Project: ADC' ... 'Module: MXN-NODE'
Related findings
The T1/NTC (text-content DPI) node's wired-config manifest (main.conf, dated 2019-01-30) sets REMOTE_DIR=ASTANA/KAZAKHTELECOM/, directly naming Kazakhtelecom — Kazakhstan's dominant state-linked telecom operator — as the carrier context for this K18 deployment. The NTC_MAAT module's EFFECTIVE_FLAG further scopes rules to {location: Astana, isp: Tanstelecom}, naming a second Kazakhstani ISP (Transtelecom) tied to the same deployment.
A recurring weekly 'Tiangou Secure Gateway — Server IP and Location of Overview' report, spanning Jan 2023 through Jan 2024 in this batch alone, tracks per-app top server IPs/geolocations/bytes for named foreign platforms (Instagram, Netflix, Reddit, Skype, Pinterest, Quora, Line, Likee, Medium, Pandora). Top consumer-side IP rows consistently resolve to Kazakhstan cities (Almaty, Pavlodar, Nur-Sultan/Astana), matching the K18 site codename. Processed-row counts grow roughly 10x over the year (889B rows/week in Jan 2023 to 9.4T rows/week in Jan 2024), and one instance reports Total Bytes Transferred of 14.66 PB and an average of 218.34 Gbps for a single week.
tsg/cli-deploy is an Ansible deployment repo for "tsg-cli" host monitoring (tsg-monitor service, rsyslog forwarding) targeting named production hosts, including hosts.astana and astana_ADC_IPlist_V1.xlsx, with a commit explicitly adding "astana部署环境IP" (Astana deployment-environment IPs) and a later branch for reading ADC hardware chassis IDs into the device serial-number scheme — concrete deployment evidence for the K18 (Kazakhstan, Astana) site.
Production network-topology docs for the Astana and Almaty (Kazakhstan / K18) sites show a live decrypted-traffic forwarding pipeline between an ADC front-end and an ASEM front-end over a direct fiber link, plus a distinct 'IP Spoofing' business function and dedicated static/dynamic proxy interception business lines, and a certificate-management endpoint (port 9991) — confirming operational TLS interception (MITM) infrastructure in production, not just lab capability, at both K18 sites.
A Kazakhstan-specific push service (galaxy/K18/galaxy-push-service) tracks per-geographic-area protocol blocking (AreaBlockProtocol, BlockingArea, EventsBlock domain classes) and pushes Top-N blocking analytics on a schedule, indicating K18's blocking is administered and reported at sub-national (area) granularity rather than applied uniformly nationwide.
A recurring weekly 'Tiangou Secure Gateway / Server IP and Location of Overseas APP' report series tracks per-app server-IP geolocation for Instagram, Snapchat, Telegram, and Likee traffic, with entries repeatedly geolocated to Almaty, Pavlodar, and Nur-Sultan, Kazakhstan across late 2023-early 2024 -- consistent with (though not conclusive proof of on its own, given ambiguity over whether the geolocated IPs are CDN edge nodes or another artifact) an operating Kazakhstan TSG deployment continuously monitoring named social/messaging platforms.