210.105.93.136📋 Copy

# IP Intelligence Briefing: 210.105.93.136

Classification: High Risk (Score: 80/100)

Date: June 2026

Prepared by: IPDebrief Intelligence Unit

## Executive Summary

IP address 210.105.93.136 is a mobile-associated web server infrastructure endpoint located in Daejeon, South Korea, operating under ASN 4766 (IP Manager). Despite exhibiting a clean subnet environment with zero abuse density, the individual endpoint demonstrates elevated risk characteristics warranting defensive attention.

## Key Risk Indicators

Network Classification:

• Mobile carrier association: KT Corporation (MCC: 450, MNC: 08)
• Connection technology: LTE/5G
• Network role: Web Server with HTTP/HTTPS/SSH services
• BGP prefix: 210.105.0.0/16 (route stability: false)

Geolocation:

• Country: South Korea (KR)
• Region: Daejeon, Dong-gu
• Coordinates: 35.91°N, 127.77°E
• RTT measurements: Avg 209.4ms, Min 207ms, Max 211ms

Threat Profile:

• Reputation: High Risk
• DNSBL listings: 5 of 8 total lists
• No direct threat indicators detected
• No known campaigns or attacker associations

## Observed Behavior

Service Footprint:

• Port 80/tcp: HTTP service
• Port 443/tcp: HTTPS service with Ruckus Wireless TLS certificate
• Port 22/tcp: SSH service

Historical Observations:

• 22 signal observations recorded since June 2018
• Recent HTTP responses showing 503 service unavailable status
• Security headers present: X-Frame-Options (SAMEORIGIN), X-Content-Type-Options (nosniff)
• No SPF/DMARC email authentication configured

Network Relationships:

• 25 relationship entries mapping to KORNET-KR network infrastructure
• Single neighbor IP (210.105.93.142) with risk score of 0
• Subnet classification: Clean, no inherited risk

## Recommended Actions

Immediate:

• Implement blocking via firewall rules for iptables, nftables, pfSense, Cloudflare WAF, and AWS WAF
• Increase logging verbosity for traffic from this IP address

Firewall Rules Provided:

```bash

# iptables

iptables -A INPUT -s 210.105.93.136 -j DROP

# nftables

nft add rule inet filter input ip saddr 210.105.93.136 drop

```

Monitoring Priority:

• Critical severity: Elevated risk score (80/100)
• Review recent activity patterns despite clean subnet classification
• Monitor for lateral movement to associated mobile infrastructure

## Risk Assessment

This IP represents a high-risk endpoint operating on mobile infrastructure with web server capabilities. While the surrounding subnet demonstrates minimal abuse density, the individual endpoint's risk profile suggests potential for malicious activity. The combination of mobile carrier association, route instability, and DNSBL presence warrants defensive containment measures.

Status: BLOCK RECOMMENDED

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.