IOC Radar
IPMediumSignal 86/100

220.122.194.247

Location
Korea, Republic ofKorea, Republic of
Gimcheon, Gyeongsangbuk-do
ASN
AS4766
Kornet
First Seen
Dec 25, 2024
Last Seen
Nov 14, 2025
Dec 25
First Seen
548d ago
Nov 14
Last Seen
224d ago
14
Reports
source reports
86%
Confidence
medium
Found in 14 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
86%
Signal Score
86 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

73 techniques

Network Information

CountryKRKorea, Republic of
RegionGimcheon, Gyeongsangbuk-do
ASNAS4766
OrganizationKornet

Feed Intelligence Summary

14 reports86% confidence
14
Source reports
86%
Confidence score
Category tags
abuseaccess controlactive scanninganomalous network connectionsasiaattackauthentication attacksbackdoorbad web botblacklisted ipblock listblock.txtblog spambotnetbotnet activitybotnet activity detectedbrute forcebrute force attackbrute force attemptbrute force attemptsc&c communicationc2c2 communicationc2 serverchina mobilecolumnscommand and controlcommunication protocolcommunication technologiescompany limitedcompromised hostcompromised hostscompromised systemscowrie honeypotcredential accesscredential harvestingcredential stuffingdaily_sourcesdata encryptiondata exfiltrationdata exfiltration attemptdata theftddosddos attackddos attacksdecoy systemdenial of servicedenial-of-service attemptdistributed attacksenumerationexploitexploit attemptsexploitation attemptsextortionftpftp brute forcehackinghashhk abusehandlerhoneytrap honeypothong konghttp brute forcehttp request anomalieshttp scannerhttp scanninghurricane usindicatorinfrastructure acquisitionreconnaissanceingress tool transferinternet of thingsintrusion detectioniociot botnetiot/ics attackkeyloggerkorea, republic oflamplateral movementmalicious activitymalicious communicationmalicious domainsmalicious filemalicious ip activitymalicious ipsmalicious linksmalicious softwaremalicious trafficmalwaremalware distributionmalware propagationmalware scanningmirai botnetmobile carriersmobile networksnetworknetwork attacksnetwork intrusionnetwork intrusion attemptsnetwork probingnetwork reconnaissancenetwork scanningnetwork securitynetwork service scanningnetwork traffic analysispassword attackspgp signphishingphishing attackpossible botnet activitypossible malware distributionprocess injectionprotocol exploitationransomwarereconnaissancereconnaissance activityremote accessremote servicesresearchedrootkitscanscannerscanning activitysecurity operationssecurity policysftp attacksmtpsmtp brute forcesmtp scanningsocial engineeringsocradar honeypotsouth koreaspamspam distributionsql injection attemptsssh attackssh monitoringsystem disruptiont1001t1001.001t1001.002t1001.003t1005t1016t1016.001t1018t1021t1021.001t1021.002t1027t1040t1041t1046t1047t1048t1053t1055t1056t1059t1059.001t1059.004t1059.005t1065t1068t1071t1071.001t1071.004t1076t1078t1078.002t1083t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1187t1189t1190t1199t1203t1204t1204.001t1204.002t1210t1486t1490t1496t1497t1499.001t1499.002t1499.003t1563t1565t1566t1566.001t1566.002t1566.003t1573t1573.001t1573.002t1587.001t1588t1590.001t1592t1595t1595.001t1595.002t1595.003tcp protocoltelecom servicestelecommunicationstelnet threatthreat actorthreat actor activitythreat detectionthreat feedthreat intelligencethreat preventiontimeouttop10.txttopips.txttrojan malwareunusual network trafficus abuseus noneuser agentvulnerability scanweb application attackweb exploitationweb securityweb spamweb trafficworm

Activity Timeline

1 total obs
Nov 14Nov 14

Threat Activity Heatmap

· Peak: 2025-11-14
Less
More
Mon
Wed
Fri
Jun
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Threat ScoreHigh Risk
86
SIGNAL
Signal Score
86%
Confidence
14
Reports
First seenDec 25, 2024
Last seenNov 14, 2025
GeolocationKR
CountryKorea, Republic of
LocationGimcheon, Gyeongsangbuk-do
ASNAS4766
OrgKornet
Coords37.3654, 127.1220

VirusTotal

Not checked

WHOIS

description
The following is the full text of the DShield.org block list, compiled by the organisation's own staff and copyrighted by its own developers, subject to copyright and other conditions, and is copyrighted. Data Sources: https://feeds.dshield.org/feeds/topips.txt https://feeds.dshield.org/feeds/top10.txt https://feeds.dshield.org/feeds/block.txt https://feeds.dshield.org/feeds/daily_sources THIS IS NOT A BLOCKLIST! DATA IS UNFILTERED AND CONTAINS FALSE POSITIVES.
raw
inetnum: 220.116.0.0 - 220.127.255.255 netname: KORNET descr: Korea Telecom admin-c: IM667-AP tech-c: IM667-AP country: KR status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR last-modified: 2017-02-06T02:32:51Z source: APNIC irt: IRT-KRNIC-KR address: 9, Jinheung-gil, Naju-si, Jeollanam-do e-mail: [email protected] abuse-mailbox: [email protected] admin-c: IM574-AP tech-c: IM574-AP auth: # Filtered remarks: [email protected] was validated on 2020-04-09 mnt-by: MNT-KRNIC-AP last-modified: 2025-04-10T04:49:23Z source: APNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IM667-AP mnt-by: MNT-KRNIC-AP last-modified: 2017-03-28T06:37:04Z source: APNIC inetnum: 220.116.0.0 - 220.127.255.255 netname: KORNET-KR descr: Korea Telecom country: KR admin-c: IA9-KR tech-c: IM9-KR status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 address: KT Head Office country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IA9-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 address: KT Head Office country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IM9-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 7 months ago
Appeared in 14 threat reports