220.94.238.64📋 Copy

## IP Intelligence Briefing: 220.94.238.64/32

Classification: High Risk (Score: 80/100) | Location: Seoul, South Korea | Provider: IP Manager (ASN: 4766)

Executive Summary:

IP 220.94.238.64 presents elevated risk characteristics with a score of 80/100. The address is associated with KT Corporation mobile infrastructure and demonstrates DNSBL listing activity across 8 lists (5 confirmed listings). No open services or direct threat indicators detected; however, the risk profile warrants defensive monitoring and potential blocking.

Technical Profile:

• Network Infrastructure: ASN 4766 (IP Manager), BGP prefix 220.92.0.0/14
• Geolocation: Seoul, South Korea (35.91°N, 127.77°E)
• Classification: Mobile device (KT LTE/5G), residential proxy characteristics
• Network State: Firewalled/no active services detected
• DNSBL Status: Listed on 5 of 8 evaluated blacklists

Threat Indicators:

• Abuse confidence score: Not quantified
• Known campaign affiliation: None identified
• Tor exit node: No
• Known attacker: No
• Spam source: No
• DNSBL listings: 5 (elevated for non-malicious traffic)

Historical Activity:

17 observations recorded with activity detected as recently as 2026-06-23. Geo-location inference from 2026-06-18 confirmed Korean origin. Operator score remains minimal (0.1304), suggesting the risk profile may be driven by DNSBL associations rather than active malicious behavior.

Neighborhood Context (220.94.238.0/24):

Subnet abuse density: 0.5 (moderate). Classification: mostly_clean. Contains 1 threat sibling (220.94.238.133, risk score 55) among 2 total siblings. Network shows mixed cleanliness characteristics.

Related Entities:

34 network relationships identified, all linked to KORNET-KR infrastructure, indicating association with Korean national network infrastructure.

Recommended Actions:

1. Immediate: Block traffic at perimeter firewall (iptables/nftables/AWS WAF/Cloudflare WAF rules available)

2. Monitoring: Increase logging verbosity and review recent activity from this IP

3. Verification: Cross-reference with internal threat intelligence before implementing permanent blocks

Firewall Rule Examples:

```

iptables -A INPUT -s 220.94.238.64 -j DROP

nft add rule inet filter input ip saddr 220.94.238.64 drop

```

---

*Intelligence generated by IPDebrief. Rules should be validated against local security policies before deployment.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.