IOC Radar
IPMediumSignal 100/100

121.151.223.185

Location
South KoreaSouth Korea
Yeongju, Gyeongsangbuk-do
ASN
AS4766
Kornet
First Seen
Aug 15, 2024
Last Seen
Apr 7, 2026
Aug 15
First Seen
670d ago
Apr 7
Last Seen
69d ago
20
Reports
source reports
99%
Confidence
medium
Found in 20 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
99%
Signal Score
100 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

31 techniques

Network Information

CountryKRSouth Korea
RegionYeongju, Gyeongsangbuk-do
ASNAS4766
OrganizationKornet

Feed Intelligence Summary

20 reports99% confidence
20
Source reports
99%
Confidence score
Category tags
abuseaccess controlaccount takeover attemptactive scanactive scanningasiaattackaustraliaauthenticationauthentication attackauthentication attacksauto-generated securityautomated attacksbad reputationbotnetbotnet activitybrute forcebrute force attackbrute force attemptcommand and controlcompromised credentialscowrie honeypotcredential accesscredential stuffingdata exfiltrationdata store exposureddosddos attemptdecoy systemdistributed attacksexploitation activityexploitation attemptfail2ban alertsfailed login attemptsfin scanfirewall detectionftp brute forceidentity & access exploitationids evasionindicatorinjection activityintrusion detectionkorea, republic oflateral movementlogin attacklogin attemptslogin brute forcelogin securitymalicious activitymalicious softwaremalwarenetworknetwork enumerationnetwork intrusionnetwork mappingnetwork probingnetwork reconnaissancenetwork scanningnull scanoceaniapassword attackpassword attacksphishingpotential vulnerability exploitationprocess injectionreconnaissancereconnaissance activityremote accessremote access attemptsresearchedrtbhscannersecurity operationssecurity policyservice scanservice version detectionsouth koreassh attackssh monitoringsyn scant1016t1018t1021t1021.001t1021.004t1046t1055t1059t1059.004t1071.001t1078t1078.004t1110t1110.001t1110.002t1110.003t1110.004t1187t1190t1486t1496t1499.002t1499.003t1565t1583t1589t1589.002t1595t1595.001t1595.002t1595.003telecommunicationsthreat actorthreat intelligencethreat preventiontor nodeudp port scanunauthorized accessunauthorized access attemptsunited kingdomvulnerability scanxmas scan

Activity Timeline

1 total obs
Apr 7Apr 7

Threat Activity Heatmap

· Peak: 2026-04-07
Less
More
Mon
Wed
Fri
Jun
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreHigh Risk
100
SIGNAL
Signal Score
99%
Confidence
20
Reports
First seenAug 15, 2024
Last seenApr 7, 2026
GeolocationKR
CountrySouth Korea
LocationYeongju, Gyeongsangbuk-do
ASNAS4766
OrgKornet
Coords36.8226, 128.6274

VirusTotal

Not checked

WHOIS

description
Bruteforce, scanning, details in pulse
raw
inetnum: 121.128.0.0 - 121.159.255.255 netname: KORNET descr: Korea Telecom admin-c: IM667-AP tech-c: IM667-AP country: KR status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR last-modified: 2017-02-03T02:22:00Z source: APNIC irt: IRT-KRNIC-KR address: 9, Jinheung-gil, Naju-si, Jeollanam-do e-mail: [email protected] abuse-mailbox: [email protected] admin-c: IM574-AP tech-c: IM574-AP auth: # Filtered remarks: [email protected] was validated on 2020-04-09 mnt-by: MNT-KRNIC-AP last-modified: 2025-09-04T01:00:01Z source: APNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IM667-AP mnt-by: MNT-KRNIC-AP last-modified: 2017-03-28T06:37:04Z source: APNIC inetnum: 121.128.0.0 - 121.159.255.255 netname: KORNET-KR descr: Korea Telecom country: KR admin-c: IA9-KR tech-c: IM9-KR status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 address: KT Head Office country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IA9-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 address: KT Head Office country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IM9-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC
references
https://redpiranha.net, https://blog.edie.io/2020/04/30/diy-ip-threat-feed/, https://github.com/tankmek/threatfeed, https://list.rtbh.com.tr/output.txt, https://github.com/telekom-security/tpotce

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 2 months ago
Appeared in 20 threat reports