IOC Radar
IPLowSignal 45/100

175.126.37.247

Location
Korea, Republic ofKorea, Republic of
Mapo-gu, Seoul
ASN
AS9318
SK Broadband Co Ltd
First Seen
Jun 22, 2025
Last Seen
Jun 7, 2026
Jun 22
First Seen
353d ago
Jun 7
Last Seen
2d ago
20
Reports
source reports
45%
Confidence
low
0/91
VirusTotal
detections
Found in 20 reports. Confidence: low. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
45%
Signal Score
45 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

76 techniques

Network Information

CountryKRKorea, Republic of
RegionMapo-gu, Seoul
ASNAS9318
OrganizationSK Broadband Co Ltd

IP Category

⟲
Proxy
Proxy server

Feed Intelligence Summary

20 reports45% confidence
20
Source reports
45%
Confidence score
Category tags
abuseaccess controlactive scanactive scanningadbhoney honeypotaerospace & defenseanomalous network connectionsapacheapache attackerasiaattackaustraliaauthentication attackauthentication_bypassautomated attackbad reputationbad web botbankingblock listblock.txtblog spambotnetbotnet activitybotnet activity detectedbrute forcebrute force attackbrute force attacksbrute force attemptbrute force attemptsc2c2 communicationchina mobilecisco devicecolumnscommand & controlcommand and controlcommunication protocolcommunication technologiescompany limitedcompromised credentialscompromised hostsconpot honeypotconsumer goodscowrie honeypotcowrie interactionscredential accesscredential harvestingcredential stuffingcredential theftcredit card servicesdaily_sourcesdata exfiltrationdata exfiltration attemptdata store exposuredatabase attacksdatabase exploitation attemptdatabase securityddosddos preparationdecoy systemdefensedefense contractingdefense logisticsdefense systemsdefense technologydenial of servicedenial-of-service attemptdevice managementdionaea honeypotdionaea interactionsdistributed attackselasticpot honeypotelasticsearch monitoringenterprise networkingeuropeexecutable fileexploit attemptsexploitation activityexploitation attemptsexploited hostfattfatt signaturesfinancefinancial servicesfinancial technologyfinlandfrancefraudfraud ordersftpftp brute forceftp brute-forcegermanyhackinghk abusehandlerhoneynet connecthoneytrap honeypothoneytrap interactionshong konghttp brute forcehttp probinghttp request anomalieshttp scannerhttp scanninghttps scanninghurricane usics securityidentity & access exploitationimapimap attackindicatorindustrial control systemsinformation technologyinitial accessinjection activityiot attacksiot device targetingiot securityiot targetediot/ics attackipphoney honeypotipqsipv4ipv4_addressit infrastructurekorea, republic oflamplamp server targetinglateral movementlogin attemptlogin brute-forcelogin failuremailoney honeypotmailoney interactionsmalicious activitymalicious loginmalicious script executionmalicious sftp activitymalicious softwaremalicious ssh activitymalicious trafficmalwaremalware behaviourmalware capturemalware distributionmediamilitary operationsmobile carriersmobile networksnational securitynetworknetwork accessnetwork attacksnetwork enumerationnetwork infrastructurenetwork intrusionnetwork intrusion attemptsnetwork intrusion detectionnetwork protocolnetwork scanningnetwork securitynetwork service scanningnetwork_service_exploitationnorth americaoceaniap0fp0f signaturespassword attackpassword attackspayment processingpgp signphishingphishing attackphishing trappolandpossible botnet activitypossible malware distributionprocess injectionprotocol exploitationproxyproxy activityreconnaissancereconnaissance activityredis honeypotremote accessremote servicesremote_accessresearchedresource hijackingretail tradescams & fraudscannerscanning activityscripting attackssecurity operationssecurity policysensor-taggedsentrypeer botnetsentrypeer interactionsserver exploitationservice scansftp access attemptsftp attacksip brute forcesip scanningsmb brute forcesmtpsmtp attackersmtp brute forcesmtp probingsmtp scanningsocial engineeringsoftware developmentsouth koreaspamsql injectionssh attackssh brute-forcessh monitoringsuricata alertsswedent1003t1005t1016t1018t1021t1021.001t1021.002t1021.003t1021.004t1021.005t1040t1041t1043t1046t1047t1048t1053t1053.005t1055t1056t1059t1059.001t1059.003t1059.004t1059.007t1065t1068t1071t1071.001t1071.002t1071.004t1076t1078t1078.004t1083t1090t1090.001t1090.002t1090.003t1110t1110.001t1110.002t1110.003t1110.004t1133t1189t1190t1203t1204.002t1486t1496t1497t1499.001t1499.002t1499.003t1505.002t1550t1552t1555t1556t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1567.001t1573t1588.004t1589t1592t1595t1595.001t1595.002t1595.003tannertanner interactionstargeting databasetcp protocoltcp scantelecom servicestelecommunicationstelnet threatthreat actorthreat actor activitythreat detectionthreat intelligencethreat preventiontimeouttop10.txttopips.txttor nodetpotudp scanunauthorized accessunauthorized access attemptunauthorized login attemptunited statesus nonevnc protocolvoipvoip attackwealth managementweb application attackweb application attacksweb attackweb exploitationweb spamweb traffic

Activity Timeline

1 total obs
Jun 7Jun 7

Threat Activity Heatmap

· Peak: 2026-06-07
Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
45
SIGNAL
Signal Score
45%
Confidence
20
Reports
First seenJun 22, 2025
Last seenJun 7, 2026
GeolocationKR
CountryKorea, Republic of
LocationMapo-gu, Seoul
ASNAS9318
OrgSK Broadband Co Ltd
Coords37.5614, 126.9960
Proxy

VirusTotal

0/ 91vendors flagged
0% detection rateJun 8, 2026

WHOIS

description
The following is the full text of the DShield.org block list, compiled by the organisation's own staff and copyrighted by its own developers, subject to copyright and other conditions, and is copyrighted. Data Sources: https://feeds.dshield.org/feeds/topips.txt https://feeds.dshield.org/feeds/top10.txt https://feeds.dshield.org/feeds/block.txt https://feeds.dshield.org/feeds/daily_sources THIS IS NOT A BLOCKLIST! DATA IS UNFILTERED AND CONTAINS FALSE POSITIVES.
raw
inetnum: 175.112.0.0 - 175.127.255.255 netname: broadNnet descr: SK Broadband Co Ltd admin-c: IM670-AP tech-c: IM670-AP country: KR status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR last-modified: 2017-02-03T00:38:20Z source: APNIC irt: IRT-KRNIC-KR address: 9, Jinheung-gil, Naju-si, Jeollanam-do e-mail: [email protected] abuse-mailbox: [email protected] admin-c: IM574-AP tech-c: IM574-AP auth: # Filtered remarks: [email protected] was validated on 2020-04-09 mnt-by: MNT-KRNIC-AP last-modified: 2025-04-10T04:49:23Z source: APNIC person: IP Manager address: Seoul Jung-gu Toegye-ro 24 country: KR phone: +82-80-828-2106 e-mail: [email protected] nic-hdl: IM670-AP mnt-by: MNT-KRNIC-AP last-modified: 2021-10-05T05:20:03Z source: APNIC inetnum: 175.112.0.0 - 175.127.255.255 netname: broadNnet-KR descr: SK Broadband Co Ltd country: KR admin-c: IM12-KR tech-c: IM12-KR status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Seoul Jung-gu Toegye-ro 24 address: SK Namsan Green Bldg. country: KR phone: +82-80-828-2106 e-mail: [email protected] nic-hdl: IM12-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC
references
https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

low
First detected 11 months ago · Last seen 2 days ago
Appeared in 20 threat reports