211.198.128.124📋 Copy

# IP Intelligence Briefing: 211.198.128.124

Classification: HIGH RISK / MOBILE ENDPOINT

Date: June 2026

Prepared by: IP Intelligence Team

## EXECUTIVE SUMMARY

IP 211.198.128.124 is a high-risk mobile endpoint operating from Seoul, South Korea. The IP demonstrates elevated threat characteristics with a risk score of 80/100 and is actively listed on 6 of 8 DNS blacklists. The address operates as a mobile carrier endpoint (KT Corporation) with single-service host profile and SSH service exposure.

## NETWORK OWNERSHIP AND GEOLOCATION

• ASN: 4766 (IP Manager)
• Organization: IP Manager
• Country: South Korea (KR)
• City/Region: Seoul
• ISP/Carrier: KT Corporation (Mobile)
• Technology: LTE/5G
• RIR: APNIC
• BGP Prefix: 211.192.0.0/13

## THREAT PROFILE

• Risk Score: 80/100
• Abuse Confidence: Elevated
• DNSBL Listings: 6/8 blacklists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0 (direct)

## NETWORK SERVICE FINGERPRINT

• Open Ports: TCP/22 (SSH - OpenSSH 8.0)
• Service Type: Single-Service Host
• Forward Resolution: Not confirmed
• PTR Records: None detected
• Email Authentication: SPF/DMARC not configured

## NEIGHBORHOOD ANALYSIS

The IP resides in subnet 211.198.128.0/24 with the following characteristics:

• Abuse Density: 1.0 (High)
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 1
• Notable Neighbor: 211.198.128.204 (Risk Score: 80, Authority Score: 50)

The neighborhood shows concentrated risk with one additional high-risk endpoint in the same /24, indicating potential coordinated activity or shared infrastructure.

## TEMPORAL ANALYSIS

• Observation Count: 19 signals recorded
• Campaign Likelihood: None detected
• Threat Persistence: Not flagged as persistently malicious
• Ownership Changes: 0
• Recent Activity: Observed as recently as June 23, 2026

## RELATIONSHIP GRAPH

The IP maintains 19 documented relationships, all classified as "Same Network" targeting KORNET-KR (Korea national network infrastructure). This indicates the endpoint is part of Korea's national network routing.

## OBSERVATION HISTORY

Historical signals show:

• Consistent mobile carrier identification
• Stable geographic attribution to Seoul
• No significant changes in ownership or network classification
• Multiple operator score assessments with minimal operator control

## RECOMMENDED ACTIONS

Based on the high-risk profile, the following defensive measures are recommended:

1. Block SSH Access: Restrict TCP/22 from this mobile endpoint at perimeter firewalls

2. Monitor for Exploitation: SSH services on mobile endpoints often indicate potential abuse for lateral movement

3. DNSBL Verification: Confirm current blacklist status across major feeds

4. Geolocation Blocking: Consider blocking all traffic from this subnet (211.198.128.0/24) if policy permits

5. Correlation: Investigate the neighboring IP 211.198.128.204 which shares the same risk score

## RISK ASSESSMENT

OVERALL RISK: HIGH

This endpoint presents a moderate to high threat profile primarily due to:

• Active DNSBL listings (6/8)
• High risk score (80)
• Mobile carrier infrastructure (potential for credential harvesting or botnet activity)
• Concentrated risk in neighboring subnet

MITIGATION PRIORITY: MEDIUM-HIGH

---

*Intelligence generated from IPDebrief platform. Data current as of June 2026.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.