222.116.34.23📋 Copy

# IP Intelligence Briefing: 222.116.34.23/32

Classification: High Risk / Mobile Network Origin

Date: June 2026

Risk Score: 80/100

## Executive Summary

IP address 222.116.34.23 is a mobile network endpoint originating from South Korea (Jeju-do, Seogwipo-si) classified under ASN 4766 (IP Manager). The IP exhibits high-risk characteristics with active blacklist listings across 5-8 threat feeds. No active services are detected; the endpoint is firewalled with no open ports. Recommended action: Block at perimeter firewall with enhanced monitoring.

## Technical Profile

## Threat Indicators

• DNSBL Status: Listed on 5 of 8 total DNSBL feeds
• Risk Classification: High Risk (80/100)
• Abuse Confidence: Not quantified
• Campaign Association: No known campaign correlations
• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False

## Observation History

The IP has generated 17 intelligence observations with the following patterns:

• Recent Activity (June 2026): Multiple high-severity blacklist listings detected across 8 threat feeds
• Listings Count: 4-5 active listings per observation window
• Max Severity: High
• Confidence Level: 0.22-0.85
• Subnet Analysis: 222.116.34.0/24 classified as "mostly_clean" with 50% abuse density
• Threat Persistence: 0 days (transient observation)

## Network Neighborhood

• Subnet: 222.116.34.0/24
• Total Siblings: 2 IPs
• Active Siblings: 0
• Threat Siblings: 1
• Neighbor IP: 222.116.34.84 (Risk Score: 0, Authority Score: 50)
• Network Classification: KORNET-KR

## Network Relationships

All 15 relationship targets map to network entities under KORNET-KR designation, indicating regional network interconnection patterns consistent with the APNIC allocation.

## Service Analysis

• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: None
• DNS Records: No forward or reverse resolution
• Email Authentication: No SPF, DMARC, or TXT records

## Recommended Security Actions

Immediate Actions (Critical)

1. Block at Perimeter Firewall

- `iptables -A INPUT -s 222.116.34.23 -j DROP`

- `nft add rule inet filter input ip saddr 222.116.34.23 drop`

- `deny 222.116.34.23` (nginx)

2. Cloud Platform Integration

- Cloudflare WAF: Block with expression `ip.src eq 222.116.34.23`

- AWS WAF: Add IP to blocklist (CIDR: 222.116.34.23/32)

- pfSense: Configure rule for 222.116.34.23/32

Monitoring Recommendations

• Logging: Increase verbosity for traffic patterns from this IP
• Review: Analyze recent activity logs for any attempted connections
• Correlation: Monitor 222.116.34.84 (neighbor) for coordinated activity

## Intelligence Assessment

This IP represents a mobile network endpoint with elevated risk posture due to active blacklist presence across multiple threat feeds. The lack of open services suggests either legitimate mobile infrastructure or an endpoint configured to receive traffic only. The 50% abuse density in the /24 subnet indicates moderate risk context. Given the high risk score (80) and recent high-severity listings, defensive blocking is recommended pending further correlation with organization-specific threat intelligence.

---

*Report generated by IPDebrief Intelligence Platform. All data sourced from real-time threat intelligence feeds and network observations.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.