211.228.113.27

Medium 10/15/30d lists

Suspicious mail authentication attempts against monitored mail infrastructure.

Request review Check AbuseIPDB JSON

Risk score47/100

Detection volume+12Sensor corroboration+5Signal class+12Recency+12

Address intelligence

cached

CountrySouth KoreaKR

City / regionJeju City, Jeju-do, South KoreaAsia/Seoul

NetworkKorea Telecomkt.com

ASNAS4766

Reverse DNS—

Detections6total observations

Reporting sensors2distinct collectors

First seen2026-05-27 14:55 GMT+82 months ago

Last seen2026-08-21 17:35 GMT+81 day ago

Blocklist window10/15/30d lists

Reporting sensors

which collectors observed this address

Mail Sensor 023 observation(s) · last 2026-08-21 17:35 GMT+8Mail
Leak Trap Sensor 023 observation(s) · last 2026-08-18 17:30 GMT+8Leak

Sensor names are anonymised. Collector hostnames and log contents are never published.

Observation history

2 signal record(s)

Suspicious mail authentication attemptsMediumMail / credential abuse
3 detection(s) from 1 sensor(s) · first seen 2026-08-21 17:35 GMT+8 · last seen 2026-08-21 17:35 GMT+8 (1 day ago) · active
Suspicious mail authentication attempts against monitored mail infrastructure.
Leak trap address contactedMediumLeak trap
3 detection(s) from 1 sensor(s) · first seen 2026-05-27 14:55 GMT+8 · last seen 2026-08-18 17:30 GMT+8 (4 days ago) · active
A monitored leak-trap address was contacted. This suggests the sender may be using exposed or scraped address data.

Abuse Radar publishes sanitized indicators only. Severity is a triage hint computed from detection volume, sensor corroboration, signal class and recency — it is not an attribution claim. See methodology.