219.248.4.146📋 Copy

INTELLIGENCE BRIEFING: 219.248.4.146/32

SUBJECT: High-Risk South Korean Multi-Service Host

DATE: Current

RISK SCORE: 80/100 (High Risk)

---

EXECUTIVE SUMMARY

Target 219.248.4.146 is a high-risk multi-service host located in Gimpo-si, Gyeonggi-do, South Korea (KR). The IP is registered under ASN 9318 (IP Manager) for the broadNnet-KR network block 219.248.0.0/14. Current reputation assessment indicates significant abuse potential with multiple blacklist listings.

---

KEY FINDINGS

Network & Ownership:

• ASN: 9318 (IP Manager)
• Organization: broadNnet-KR
• CIDR Block: 219.248.0.0/14
• RIR: APNIC
• Location: South Korea, Gyeonggi-do, Gimpo-si (35.91°N, 127.77°E)

Threat Indicators:

• Blacklist Status: Listed on 5 of 8 total DNSBL lists (max severity: HIGH)
• Risk Score: 80/100 (High Risk classification)
• Abuse Confidence: Present (multiple blacklist sources)
• Not classified as Tor exit node, known attacker, spam source, or proxy

Network Services:

• Port 22 (SSH): Open — Banner indicates OpenSSH_7.9p1 Raspbian
• Port 3389 (RDP): Open — Remote Desktop Protocol listening
• DNS: No PTR records, no reverse resolution confirmed
• Email Authentication: SPF/DMARC not configured

Control Plane:

• Operator Score: 0.1304 (Minimal)
• DNSSEC: Valid
• Route stability: Unstable (isRouteStable: false)
• RPKI/IRR: No consistency data available

---

OBSERVATION HISTORY

• Total Observations: 18
• Recent Activity:

- June 23, 2026: High-severity blacklist listing detected (5/8 total lists)

- June 18, 2026: Prior high-severity listing observed

• Threat Persistence: Single threat observation (0 days persistent)
• Status: Not persistently malicious

Neighborhood Analysis (219.248.4.0/24):

• Abuse Density: 1
• Classification: Mostly clean
• Threat siblings: 1 active threat IP identified

---

RELATIONSHIP MAPPING

• 19 relationships identified, all mapping to same network (broadNnet-KR)
• No external organization, hostname, or certificate relationships detected
• Correlation indicates network-based infrastructure

---

RECOMMENDED ACTIONS

Immediate (Critical):

1. Block traffic at perimeter firewall using provided rules

2. Increase logging verbosity for all traffic from this source

3. Review recent activity from 219.248.4.146 for malicious patterns

Firewall Rules Available:

• iptables: `iptables -A INPUT -s 219.248.4.146 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 219.248.4.146 drop`
• nginx: `deny 219.248.4.146;`
• Cloudflare WAF: Block with expression `ip.src eq 219.248.4.146`
• AWS WAF: Add 219.248.4.146/32 to block list

---

SOC ANALYST NOTES

• SSH and RDP services are exposed to the internet; verify if legitimate use case exists
• Multiple blacklist listings indicate prior abuse attempts or confirmed malicious activity
• OpenSSH Raspbian banner suggests potential compromised Raspberry Pi device
• Consider blocking entire /24 subnet (219.248.4.0/24) if broader infrastructure risk is confirmed
• Monitor for additional IPs from ASN 9318 showing similar patterns

END BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.