118.45.247.129📋 Copy

## THREAT INTELLIGENCE BRIEFING

Target IP: 118.45.247.129/32

Date: 2026-07-30

Classification: Moderate Risk

---

EXECUTIVE SUMMARY

IP 118.45.247.129 is a mobile carrier address assigned to KT Corporation (KT) in Daegu, South Korea. The address exhibits a moderate risk score of 50, primarily driven by mobile carrier classification and DNSBL listings, with no active threat indicators or persistent malicious behavior observed.

---

OWNERSHIP & GEOLOCATION

---

THREAT PROFILE

• Risk Score: 50 (Moderate Risk)
• Abuse Confidence: Not applicable
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• DNSBL Listings: 2 of 8 total lists
• Open Ports/Services: None detected
• TLS Certificate: None
• Campaign Affiliation: None identified

---

OBSERVATION HISTORY

The IP has been observed 13 times with consistent characteristics:

• Geolocation: Stable South Korea (Daegu) across all observations
• Ownership: 0 changes detected; persistent assignment
• Threat Persistence: 0 days; not persistently malicious
• Route Stability: Unstable routing (isRouteStable: false)
• Recent Activity: Last observation recorded 2026-07-30T19:39:19

---

NETWORK RELATIONSHIPS

• Same Network: KORNET-KR (2 relationships)
• Related Entities: No external hostnames, domains, or certificate associations detected
• Campaign Correlations: 0 correlated IPs

---

NEIGHBORHOOD ANALYSIS

Subnet: 118.45.247.0/24

• Abuse Density: 0 (Clean)
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0
• Classification: Clean

---

SECURITY RECOMMENDATIONS

Based on risk score of 50 and mobile carrier classification:

Recommended Actions:

• Block: Consider blocking on perimeter firewalls due to DNSBL listings
• Monitor: Maintain monitoring for any behavioral changes

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 118.45.247.129 -j DROP

# nftables

nft add rule inet filter input ip saddr 118.45.247.129 drop

```

WAF/CDN Rules:

• Cloudflare WAF: Block with expression `ip.src eq 118.45.247.129`
• AWS WAF: Add 118.45.247.129/32 to IP set

---

ASSESSMENT

This IP represents a legitimate mobile carrier address with moderate risk scoring. The risk profile is primarily driven by:

1. Mobile carrier classification (common for residential IPs)

2. DNSBL presence (2 listings)

3. Unstable routing configuration

No active threat indicators were detected. The IP does not exhibit characteristics of known malicious infrastructure. Recommend blocking with awareness that this is a legitimate mobile address, not an active threat source.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.