116.120.97.12📋 Copy

# IP Intelligence Briefing: 116.120.97.12

## Executive Summary

Target IP 116.120.97.12 is a low-risk residential address from South Korea with no active service exposure. The IP is currently in a clean neighborhood with zero abuse density and no historical threat persistence. Recommended action: Monitor but no immediate blocking required.

## Network Classification & Ownership

• ASN: 9318 (IP Manager / broadNnet-KR)
• Network: 116.120.0.0/13 (APNIC RIR)
• Location: Gyeonggi-do, Seongnam-si, South Korea (35.91°N, 127.77°E)
• Geolocation Confidence: 0.52 (multi-signal inference)
• Network Role: Firewalled / No Services
• Cloud/CDN/Proxy: Not detected

## Risk Assessment

## Threat Intelligence

• Known Campaigns: None
• Campaign Likelihood: Not detected
• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No
• Threat Feeds: Empty
• Threat Persistence: 0 days observed

## Behavioral Analysis

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Total Incidents: 0
• Service Status: No open ports, no TLS certificates, no HTTP services

## Historical Observation (22 Total)

• Recent Activity: Observations from June 2026
• DNSBL Activity: 1 listing detected with high severity designation
• Geolocation: Consistent KR classification across all observations
• Stability: No ownership changes detected

## Relationship Graph

• Same Network: 41 entries (broadNnet-KR)
• External Relationships: None (no hostnames, organizations, or certificates)
• Campaign Correlations: 0

## Neighborhood Analysis (/24 Subnet)

• Subnet: 116.120.97.12/24
• Abuse Density: 0 (Clean)
• Active Siblings: 0
• Threat Siblings: 0
• Classification: Clean

## SOC Actionable Intelligence

The IP address 116.120.97.12 presents minimal threat. Current state indicates a residential or firewalled endpoint with no active service exposure. The single DNSBL listing noted in historical data should be reviewed but does not indicate active malicious behavior. The IP operates in a clean subnet with no correlated threat activity.

Recommended Actions:

• Immediate: No blocking required
• Monitoring: Continue standard passive monitoring
• Threshold: Block only if new threat indicators emerge (risk score > 50)

Priority: Low

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.