South Korea (KR) Threat Intelligence

KR

South Korea has 64,136 malicious IP addresses with 3,711,140 abuse reports. Top threat categories include tcp scan, high threat, suspicious activity, malware distribution, severe abuse. Top attacking networks: Korea Telecom (23,049 IPs), LARUS Limited (11,235 IPs), SK Broadband Co Ltd (2,986 IPs). Data collected since 2022-12-19, last activity 2026-10-13.

Threat Assessment: South Korea shows substantial cyber threat activity, ranking among the top threat source countries worldwide. The dominant attack types are tcp scan, high threat, suspicious activity. The majority of threats originate from networks operated by Korea Telecom and LARUS Limited.

Total Reports
3,711,140
Unique IPs
64,136
First Seen
2022-12-19
Last Activity
2026-10-13

Top Threat Categories

Tcp Scan 597,926
High Threat 368,241
Suspicious Activity 273,304
Malware Distribution 84,972
Severe Abuse 30,454

Top Attacking Networks

AS4766 Korea Telecom
23,049 IPs
AS17561 LARUS Limited
11,235 IPs
AS9318 SK Broadband Co Ltd
2,986 IPs

Most Reported IPs in South Korea

211.106.133.202 1,664 reports
211.223.107.86 1,645 reports
118.37.214.187 1,642 reports
222.108.100.117 1,627 reports
211.178.247.182 1,611 reports

Access this data via API

Get South Korea threat intelligence programmatically.

curl https://ip.wayscloud.services/api/country/KR

View full API documentation

See how we classify and verify threats →

Check any IP from South Korea

Look up threat intelligence for a specific IP address.

Related: Country Threat Ranking Country Risk Trends → Top Malicious IPs → AS4766 Intelligence AS17561 Intelligence AS9318 Intelligence Global Attack Trends Detect Malicious Traffic

Loading threat intelligence data...