119.192.210.110📋 Copy

# IP Intelligence Briefing: 119.192.210.110/32

Classification: HIGH RISK

Date: 2026-06-22

IP Address: 119.192.210.110/32

Risk Score: 80/100

---

## Executive Summary

IP 119.192.210.110 is a mobile carrier-allocated IP address from South Korea (Seoul) operating under AS4766 (IP Manager). Despite showing no active services and being firewalled, the IP registers a high risk score of 80/100, with 5 out of 8 DNSBL listings and 1 threat sibling in its /24 subnet. Recommended action: block at perimeter defenses and increase logging for forensic analysis.

---

## Technical Profile

---

## Threat Indicators

• Risk Score: 80/100 (High Risk)
• DNSBL Listings: 5 of 8 total lists
• Operator Score: 0.1304 (Minimal)
• Campaign Likelihood: None identified
• Known Campaigns: None
• Blacklist Count: 0 (commercial lists)
• Threat Feeds: No active detections

The IP shows no open ports, no TLS certificates, and no HTTP services. The absence of active services suggests the IP is either dormant, misconfigured, or used for short-duration mobile communications.

---

## Neighborhood Analysis

Subnet: 119.192.210.110/24

• Abuse Density: 1
• Classification: mostly_clean
• Inherited Risk: 2
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 1

One threat sibling detected within the /24 subnet. The IP demonstrates route instability (isRouteStable: false).

---

## Historical Observations (16 Signals)

Recent observation timeline:

• 2026-06-22T11:05:48Z: Operator score 0.15, DNSSEC validated
• 2026-06-17T07:11:03Z: Subnet abuse density 1, inherited risk 2
• 2026-06-17T07:07:10Z: Geolocation confirmed: Seoul, KR (confidence 0.52)

Threat observation count: 1

Persistence days: 0

Stable ownership: No changes

---

## Relationship Graph

15 relationships identified:

• All classified as "Same Network"
• Network identifier: KORNET-KR (Korea)

---

## Recommended Actions

Monitoring

• Increase logging verbosity for traffic from 119.192.210.110
• Review recent activity logs for suspicious patterns

Firewall Rules

iptables:

```

iptables -A INPUT -s 119.192.210.110 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 119.192.210.110 drop

```

nginx:

```

deny 119.192.210.110;

```

pfSense:

```

119.192.210.110/32

```

Cloudflare WAF:

```json

{

"description": "Block 119.192.210.110 — IPDebrief risk score 80",

"action": "block",

"filter": {"expression": "ip.src eq 119.192.210.110"}

}

```

AWS WAF:

```json

{

"Addresses": ["119.192.210.110/32"],

"Description": "IPDebrief risk 80"

}

```

---

## Analyst Notes

This IP exhibits high-risk characteristics despite lacking active service endpoints. The mobile carrier attribution (KT Corporation) and DNSBL listings suggest potential abuse for short-duration connections. The single threat sibling in the /24 subnet warrants monitoring for correlated activity. Recommend blocking at perimeter defenses and correlating with internal logs for any observed traffic.

Status: Block and Monitor

Priority: Critical

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.