218.149.170.76📋 Copy

## IP INTELLIGENCE BRIEFING: 218.149.170.76/32

Classification: High Risk (Score: 70/100)

Analysis Date: 2026-06-25

Reporting Authority: IPDebrief Intelligence Division

---

EXECUTIVE SUMMARY

Target IP 218.149.170.76 is classified as High Risk with a risk score of 70/100. The address is associated with Korea Telecom (ASN 4766) and geolocated to Seogwipo, Jeju-do, South Korea. Network classification indicates mobile carrier traffic (KT Corporation, LTE/5G technology). The IP has been listed on 4 DNS blacklists and shows elevated risk indicators warranting defensive action.

---

TECHNICAL PROFILE

Ownership & Network:

• ASN: 4766 (KIXS-AS-KR-KR - Korea Telecom)
• Organization: IP Manager
• Registry: APNIC
• Network Prefix: 218.144.0.0/13
• Route Stability: Not stable (isRouteStable: false)

Geolocation:

• Country: South Korea (KR)
• Region: Jeju-do
• City: Seogwipo
• Coordinates: 35.91°N, 127.77°E
• Accuracy Radius: 250 km

Network Role:

• Classification: Mobile
• Carrier: KT Corporation (MCC: 450, MNC: 08)
• Technology: LTE/5G
• Services: No open ports detected (Firewalled / No Services)

---

THREAT INDICATORS

Risk Profile:

• Overall Risk Score: 70/100 (High Risk)
• Abuse Confidence Score: Not available
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• DNSBL Listings: 4/8 total lists

Control Plane Analysis:

• RPKI State: Not validated
• IRR Consistency: Not assessed
• DNSSEC Valid: Yes
• Operator Score: 0.1304 (Minimal)
• Threat Observation Count: 1

---

OBSERVATION HISTORY

Total Observations: 19 signals recorded

Most Recent Activity: 2026-06-25T06:09:50 UTC

Key Historical Signals:

1. ASN Resolution: 2026-06-25 - ASN 4766 (Korea Telecom)

2. Geolocation: 2026-06-25 - Seogwipo, KR (confidence: 0.52)

3. Operator Classification: 2026-06-25 - "Minimal" operator score

4. Network Role: 2026-06-05 - No CDN/Proxy/Tor/Cloud indicators

5. Network Type: 2026-06-05 - Mobile classification confirmed

The IP demonstrates consistent geolocation and ASN attribution over the observation period with no significant ownership changes.

---

NETWORK RELATIONSHIPS

Total Relationships: 12

Primary Network: KORNET-KR (Korea Telecom)

All relationships indicate connectivity within the same network infrastructure (KORNET-KR), confirming the IP operates within Korea Telecom's network backbone. No cross-network associations detected.

---

NEIGHBORHOOD ANALYSIS

Subnet: 218.149.170.76/24

Abuse Density: 0 (mostly_clean classification)

Total Siblings: 1

Active Siblings: 0

Threat Siblings: 1

The /24 subnet shows minimal abuse density with inherited risk score of 2. This indicates the target IP is an outlier within its local subnet, operating independently from neighboring addresses.

---

RECOMMENDED ACTIONS

Severity: HIGH

Category: Monitoring & Blocking

Recommended Firewall Rules:

Additional Recommendations:

1. Increase logging verbosity for traffic from this IP address

2. Review recent activity patterns for anomalies

3. Monitor for new DNSBL listings (currently 4/8)

4. Validate blocking rules in staging environments before deployment

---

ANALYST NOTES

The IP address presents moderate-to-high risk primarily due to its classification on multiple DNS blacklists and elevated risk score. Despite mobile carrier classification and lack of open services, the DNSBL listings suggest prior malicious activity or association with compromised endpoints. The consistent geolocation and network attribution indicate persistent operation rather than transient scanning behavior. Recommended blocking with logging for intelligence gathering purposes.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.