175.207.239.76📋 Copy

# IP Intelligence Briefing: 175.207.239.76/32

## Executive Summary

IP address 175.207.239.76 is classified as high risk with a risk score of 70/100. The IP is registered to ASN 4766 (IP Manager) under APNIC and is located in Jeju City, South Korea (KR). The address is associated with mobile carrier KT Corporation and operates as a web server with HTTP, HTTPS, and SSH services enabled.

## Risk Profile

The IP received a risk score of 70, indicating elevated threat activity. The address appears on four out of eight DNS blacklist lists. Control plane analysis shows BGP origin through ASN 4766 with prefix 175.200.0.0/13. RPKI validation and IRR consistency were not definitively resolved in available data. The operator score registered as "Basic" (0.3478), suggesting limited routing infrastructure.

## Geolocation and Ownership

Geolocation data indicates South Korea (KR) with coordinates 35.91°N, 127.77°E in Jeju City. The IP is associated with mobile carrier KT Corporation (KT), utilizing LTE/5G connection technology. Ruckus Wireless Inc. issued an SSL certificate (SN-382202006472) associated with this address.

## Network Services

Open ports identified:

• Port 80/TCP: HTTP
• Port 443/TCP: HTTPS (TLS certificate present)
• Port 22/TCP: SSH

HTTP probing returned 503 Service Unavailable responses with HTTP/1.1 protocol. The server did not present identifiable application banners or technology fingerprints.

## Threat Indicators

Current threat indicators include blacklist presence across multiple feeds. The IP is not identified as a Tor exit node or known attacker. No active campaigns were correlated. The temporal data shows one threat observation with zero persistent malicious activity detected.

## Neighborhood Analysis

Subnet 175.207.239.76/24 shows mostly_clean classification with abuse density of 0. Two sibling IPs exist in the /24 range, with one active threat sibling identified at 175.207.239.222 (risk score 70, authority score 50).

## Observation History

28 signals were recorded over the observation period. Recent listings show blacklisting activity across 8 total lists with maximum severity rated high. Geolocation inference consistently points to South Korea. Operator assessments remain at Basic level.

## Recommended Actions

Based on the risk profile, the following defensive measures are recommended:

Firewall Rules:

• iptables: `iptables -A INPUT -s 175.207.239.76 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 175.207.239.76 drop`
• nginx: `deny 175.207.239.76;`
• pfSense: `175.207.239.76/32`
• Cloudflare WAF: Block with expression `ip.src eq 175.207.239.76`
• AWS WAF: Add to address set `175.207.239.76/32`

Monitoring:

Increase logging verbosity and review recent activity from this IP due to the elevated risk score of 70/100.

## Intelligence Conclusion

IP 175.207.239.76 represents a high-risk endpoint requiring defensive attention. The combination of blacklist presence, operator classification, and neighborhood threat density suggests potential abuse activity. Recommended firewall blocking is supported by the risk score assessment, though correlation with additional threat intelligence feeds is advised before implementing permanent blocking policies.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.