IOC Radar
IPHighVerifiedSignal 86/100

175.200.104.40

Location
Korea, Republic ofKorea, Republic of
Changwon, 48
ASN
AS4766
Kornet
First Seen
Oct 28, 2025
Last Seen
Jun 14, 2026
Oct 28
First Seen
238d ago
Jun 14
Last Seen
9d ago
75
Reports
source reports
95%
Confidence
high
Found in 75 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
95%
Signal Score
86 / 100
IDS Rule
Yes
Threat Context
Threat Actors1
KKimsuky
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

49 techniques

Network Information

CountryKRKorea, Republic of
RegionChangwon, 48
ASNAS4766
OrganizationKornet

IP Category

⊕
VPN
VPN exit node

Feed Intelligence Summary

75 reports95% confidence
AT
Abuse.ch ThreatFox
Jun 14, 2026
Abuse.ch ThreatFox (3277 indicators)
2818 IOCs in report
AT
Abuse.ch ThreatFox
Jun 14, 2026
Abuse.ch ThreatFox (3395 indicators)
2934 IOCs in report
AT
Abuse.ch ThreatFox
Jun 14, 2026
Abuse.ch ThreatFox (3405 indicators)
2946 IOCs in report
AT
Abuse.ch ThreatFox
Jun 14, 2026
Abuse.ch ThreatFox (3404 indicators)
2945 IOCs in report
AT
Abuse.ch ThreatFox
Jun 14, 2026
Abuse.ch ThreatFox (3413 indicators)
2950 IOCs in report
AT
Abuse.ch ThreatFox
Jun 14, 2026
Abuse.ch ThreatFox (3369 indicators)
2906 IOCs in report
AT
Abuse.ch ThreatFox
Jun 14, 2026
Abuse.ch ThreatFox (3373 indicators)
2910 IOCs in report
AT
Abuse.ch ThreatFox
Jun 14, 2026
Abuse.ch ThreatFox (3371 indicators)
2908 IOCs in report
AT
Abuse.ch ThreatFox
Jun 14, 2026
Abuse.ch ThreatFox (3370 indicators)
2905 IOCs in report
AT
Abuse.ch ThreatFox
Jun 13, 2026
Abuse.ch ThreatFox (3418 indicators)
2953 IOCs in report

Activity Timeline

48 total obs
Jun 14Jun 12

Threat Activity Heatmap

· Peak: 2026-06-13
Less
More
Mon
Wed
Fri
Jun
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
24h
0
Dormant
7d
0
Dormant
30d
48
Critical
3mo
48
Critical
Threat ScoreHigh Risk
86
SIGNAL
Signal Score
95%
Confidence
75
Reports
First seenOct 28, 2025
Last seenJun 14, 2026
Verified IOC
GeolocationKR
CountryKorea, Republic of
LocationChangwon, 48
ASNAS4766
OrgKornet
Coords34.8341, 127.8917
VPN

VirusTotal

Not checked

WHOIS

raw
inetnum: 175.192.0.0 - 175.207.255.255 netname: KORNET descr: Korea Telecom country: KR admin-c: IM667-AP tech-c: IM667-AP status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR last-modified: 2025-11-03T08:14:04Z source: APNIC irt: IRT-KRNIC-KR address: 9, Jinheung-gil, Naju-si, Jeollanam-do e-mail: [email protected] abuse-mailbox: [email protected] admin-c: IM574-AP tech-c: IM574-AP auth: # Filtered remarks: [email protected] was validated on 2020-04-09 mnt-by: MNT-KRNIC-AP last-modified: 2025-09-04T01:00:01Z source: APNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IM667-AP mnt-by: MNT-KRNIC-AP last-modified: 2017-03-28T06:37:04Z source: APNIC inetnum: 175.192.0.0 - 175.207.255.255 netname: KORNET-KR descr: Korea Telecom country: KR admin-c: IA9-KR tech-c: IM9-KR status: ALLOCATED PORTABLE mnt-by: MNT-KRNIC-AP mnt-irt: IRT-KRNIC-KR remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 address: KT Head Office country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IA9-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC person: IP Manager address: Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90 address: KT Head Office country: KR phone: +82-2-500-6630 e-mail: [email protected] nic-hdl: IM9-KR mnt-by: MNT-KRNIC-AP changed: [email protected] 20240912 remarks: This information has been partially mirrored by APNIC from remarks: KRNIC. To obtain more specific information, please use the remarks: KRNIC whois server at whois.kisa.or.kr. source: KRNIC
references
https://purplesynapz.com/, https://jamesbrine.com.au/vultrmelbournetest-portscan-bruteforce-ip-list-2026-03-24/, https://jamesbrine.com.au, https://jamesbrine.com.au/vultrtokyo-portscan-bruteforce-ip-list-2026-04-16/, https://jamesbrine.com.au/vultrtokyo-portscan-bruteforce-ip-list-2026-03-13/, https://github.com/telekom-security/tpotce, https://voidvendor.com/intel, https://jamesbrine.com.au/vultrtokyo-portscan-bruteforce-ip-list-2026-04-02/, https://jamesbrine.com.au/vultrmelbournetest-portscan-bruteforce-ip-list-2026-03-01/, https://jamesbrine.com.au/digitaloceansingapore-portscan-bruteforce-ip-list-2026-02-26/, https://www.linkedin.com/posts/starlightintel_starlight-cti-activity-7390040954386280449-QTB6?utm_source=share&utm_medium=member_desktop&rcm=ACoAADM4tMgBAoph1aAnRhGdecMXg-lVzkLrxyM, https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 7 months ago · Last seen 9 days ago
Appeared in 75 threat reports from 10 sources
Associated with: Kimsuky
Used by malware: Remcos, Rhysida, WannaCry, AsyncRAT, Lumma, Pegasus, Nanocore, SocGholish, XWorm, Stealc, Mirai, Vidar, Havoc, Sliver, Metasploit