IOC Radar
IPMediumSignal 74/100

220.82.200.159

Location
Korea, Republic ofKorea, Republic of
Gunsan, Jeollabuk-do
ASN
AS4766
Kornet
First Seen
May 6, 2026
Last Seen
Jun 7, 2026
May 6
First Seen
45d ago
Jun 7
Last Seen
13d ago
12
Reports
source reports
74%
Confidence
medium
13/91
VirusTotal
detections
Found in 12 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
74%
Signal Score
74 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

2 techniques

Network Information

CountryKRKorea, Republic of
RegionGunsan, Jeollabuk-do
ASNAS4766
OrganizationKornet

Feed Intelligence Summary

12 reports74% confidence
12
Source reports
74%
Confidence score
Category tags
abuseactive scanaptasiaaustraliabad reputationbad web botbanner-grabbingblocklistbotnet activitybrute forcebrute-forcebruteforcecommunity-sharedddosddos attackexploitexploitation activityexploited hosthackingindicatorkrmalwarenetworkoceaniaping of deathresearchedscanscannersipsouth koreaspamsshssh attackt1110t1595threat actortpotvulnerability scanvulnerability-exploitationweb app attackweb spam

Activity Timeline

1 total obs
Jun 7Jun 7

Threat Activity Heatmap

· Peak: 2026-06-07
Less
More
Mon
Wed
Fri
Jun
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreHigh Risk
74
SIGNAL
Signal Score
74%
Confidence
12
Reports
First seenMay 6, 2026
Last seenJun 7, 2026
GeolocationKR
CountryKorea, Republic of
LocationGunsan, Jeollabuk-do
ASNAS4766
OrgKornet
Coords35.8017, 126.8889

VirusTotal

13/ 91vendors flagged
14% detection rateJun 12, 2026

WHOIS

description
Score: 50/100. Labels: abuseipdb:brute-force, abuseipdb:critical, abuseipdb:hacking, abuseipdb:port-scan, abuseipdb:reported, abuseipdb:ssh. Attacker IP 220.82.200.159 observed using SSH client fingerprint 'Unknown SSH Client (16443846184e)' 3 times when connecting to db4lamedtech between 2026-05-07 00:28 and 2026-05-07 00:28 UTC.
raw
inetnum: 220.80.0.0 - 220.87.255.255 netname: KORNET descr: Korea Telecom country: KR admin-c: IM667-AP tech-c: IM667-AP status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR last-modified: 2025-11-03T08:15:08Z source: APNIC irt: IRT-KRNIC-KR address: 9, Jinheung-gil, Naju-si, Jeollanam-do e-mail: [email protected] abuse-mailbox: [email protected] admin-c: IM574-AP tech-c: IM574-AP auth: # Filtered remarks: [email protected] was validated on 2020-04-09 mnt-by: MNT-KRNIC-AP last-modified: 2025-09-04T01:00:01Z source: APNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IM667-AP mnt-by: MNT-KRNIC-AP last-modified: 2017-03-28T06:37:04Z source: APNIC inetnum: 220.80.0.0 - 220.87.255.255 netname: KORNET-KR descr: Korea Telecom country: KR admin-c: IA9-KR tech-c: IM9-KR status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 address: KT Head Office country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IA9-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 address: KT Head Office country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IM9-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 month ago · Last seen 13 days ago
Appeared in 12 threat reports