IOC Radar
IPMediumSignal 23/100

59.13.47.85

Location
Korea, Republic ofKorea, Republic of
Suwon, 41
ASN
AS4766
Korea Telecom
First Seen
May 16, 2024
Last Seen
Apr 7, 2026
May 16
First Seen
767d ago
Apr 7
Last Seen
76d ago
8
Reports
source reports
23%
Confidence
medium
Found in 8 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
23%
Signal Score
23 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

33 techniques

Network Information

CountryKRKorea, Republic of
RegionSuwon, 41
ASNAS4766
OrganizationKorea Telecom

Feed Intelligence Summary

8 reports23% confidence
8
Source reports
23%
Confidence score
Category tags
abuseactive scanactive scanningadbhoney honeypotasiaattackbad reputationbotnetbotnet activitybrute forcebrute force ftpbrute force sshcommand and controlcommunication protocolcowrie activitycowrie honeypotcredential accesscredential harvestingcredential stuffingdata exfiltrationdata store exposuredecoy systemdionaea activitydionaea honeypotdirectory traversaldistributed attacksexploit attemptsexploitation activityftp brute forceheralding activityhoneytrap activityhoneytrap honeypotidentity & access exploitationindicatorinjection activitykorea, republic oflamplamp exploitation attemptsmailoney activitymailoney honeypotmalicious activitymalicious email activitymalicious softwaremalwaremalware behaviourmalware capturenetworknetwork scanningnetwork securitynetwork service scanningphishingphishing attackphishing trapprocess injectionreconnaissanceresearchedresource hijackingscannersentrypeer activitysentrypeer botnetservice scansftp activitysftp attacksip brute forcesip scanningsocial engineeringsouth koreassh attackssh monitoringt1021t1021.001t1021.002t1021.004t1021.006t1021.007t1040t1041t1055t1059t1059.004t1068t1071.001t1078t1110t1110.001t1110.002t1190t1204.002t1486t1496t1499.001t1499.002t1499.003t1565t1566.001t1566.002t1566.003t1566.004t1595t1595.001t1595.002t1595.003telecommunicationsthreat actorthreat detectionthreat intelligencetor nodevoipvoip attackweb application attack

Activity Timeline

1 total obs
Apr 7Apr 7

Threat Activity Heatmap

· Peak: 2026-04-07
Less
More
Mon
Wed
Fri
Jun
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreLow Risk
23
SIGNAL
Signal Score
23%
Confidence
8
Reports
First seenMay 16, 2024
Last seenApr 7, 2026
GeolocationKR
CountryKorea, Republic of
LocationSuwon, 41
ASNAS4766
OrgKorea Telecom
Coords37.2345, 127.1968

VirusTotal

Not checked

WHOIS

description
2025-02-26T16:34:04.877Z Honeypot : Adbhoney : EventID/src_ip/src_url: adbhoney.session.closed59.13.47.85
raw
inetnum: 59.0.0.0 - 59.31.255.255 netname: KORNET descr: Korea Telecom admin-c: IM667-AP tech-c: IM667-AP country: KR status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR last-modified: 2017-02-03T02:21:55Z source: APNIC irt: IRT-KRNIC-KR address: 9, Jinheung-gil, Naju-si, Jeollanam-do e-mail: [email protected] abuse-mailbox: [email protected] admin-c: IM574-AP tech-c: IM574-AP auth: # Filtered remarks: [email protected] was validated on 2020-04-09 mnt-by: MNT-KRNIC-AP last-modified: 2025-04-10T04:49:23Z source: APNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IM667-AP mnt-by: MNT-KRNIC-AP last-modified: 2017-03-28T06:37:04Z source: APNIC inetnum: 59.0.0.0 - 59.31.255.255 netname: KORNET-KR descr: Korea Telecom country: KR admin-c: IA9-KR tech-c: IM9-KR status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 address: KT Head Office country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IA9-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 address: KT Head Office country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IM9-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC
references
https://raw.githubusercontent.com/ahamed-rizvan/IOCs/refs/heads/main/Malicous%20IP%20Address.txt, https://github.com/telekom-security/tpotce

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 2 years ago · Last seen 2 months ago
Appeared in 8 threat reports