Malicious IPs in South Korea
IPv4 networks located in South Korea that are currently flagged for malicious activity, aggregated from multiple external and internal threat intelligence sources. Snapshot of (UTC), updated daily.
South Korea at a glance
South Korea had 1,066 flagged IPv4 networks in the snapshot of 2026-10-10, rank #4 of 176 countries by absolute count. Relative to its allocated IPv4 space that is 9.47 flagged networks per million addresses, rank #42 of 77, close to the median of 10.6 across all rated countries. The largest category is brute force sources with 78% of the flagged networks, followed by spam sources (13%). The three networks (ASNs) with the most flagged IPs hold 85% of them, led by KIXS-AS-KR-KR - Korea Telecom (AS4766).
Malicious activity in South Korea by category
A network listed in several categories counts once, in the most specific one.
Brute force sources in South Korea
827 (78%)827 flagged networks, #4 of 159 countries for brute force sources. Sources of password guessing against SSH, mail, FTP and web logins. Brute Force Sources by Country
Spam sources in South Korea
143 (13%)143 flagged networks, #3 of 85 countries for spam sources. Sources of email spam. Spam Sources by Country
Other malicious networks in South Korea
64 (6%)64 flagged networks, #16 of 147 countries for other malicious networks. Addresses and ranges reported as malicious without a more specific category. Other Malicious Networks by Country
Scanners in South Korea
17 (2%)17 flagged networks, #12 of 44 countries for scanners. Hosts scanning or probing services on the internet. Scanners by Country
Botnet hosts in South Korea
9 (1%)9 flagged networks, #37 of 126 countries for botnet hosts. Infected hosts taking part in a botnet. Botnet Hosts by Country
C2 servers in South Korea
6 (1%)6 flagged networks, #16 of 52 countries for C2 servers. Command-and-control servers, payload hosts and other attacker-run infrastructure. C2 Servers by Country
Networks with the most flagged IPs in South Korea
Autonomous systems announcing the flagged networks located in South Korea.
| # | Network | Flagged networks |
|---|---|---|
| 1 | AS4766KIXS-AS-KR-KR - Korea Telecom | 828 |
| 2 | AS9318SKB-AS-KR - SK Broadband Co Ltd | 46 |
| 3 | AS3786LGDACOM-KR - LG DACOM Corporation | 36 |
| 4 | AS45102ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. | 23 |
| 5 | AS9694SEOKYUNG-CATV-AS-KR-KR - Seokyung Cable Television Co.. Ltd. | 21 |
| 6 | AS8075MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation | 19 |
| 7 | AS31898ORACLE-BMC-31898 - Oracle Corporation | 13 |
| 8 | AS132203TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue | 10 |
| 9 | AS17858POWERVIS-AS-KR-KR - LG POWERCOMM | 9 |
| 10 | AS9946CABLENET-AS-KR-KR - KCTV JEJU BROADCASTING | 5 |
Compare South Korea with other countries
Ranked by flagged networks per million allocated IPv4 addresses.
Countries ranked next to South Korea by rate
| # | Country | Networks | Per million |
|---|---|---|---|
| 40 | Kenya | 65 | 10.4 |
| 41 | Netherlands | 481 | 9.55 |
| 42 | South Korea | 1,066 | 9.47 |
| 43 | Lithuania | 37 | 8.95 |
| 44 | Türkiye | 132 | 7.84 |
| 45 | Israel | 63 | 7.81 |
Other countries in the APNIC region
| # | Country | Networks | Per million |
|---|---|---|---|
| 3 | Bangladesh | 166 | 79.5 |
| 4 | Pakistan | 425 | 74.8 |
| 5 | Nepal | 41 | 70.0 |
| 8 | Sri Lanka | 26 | 46.1 |
| 9 | India | 1,777 | 42.3 |
| 11 | Hong Kong SAR China | 500 | 31.0 |
| 12 | Philippines | 188 | 30.0 |
| 21 | Indonesia | 408 | 21.0 |
Questions about South Korea
- How many malicious IP addresses are there in South Korea?
- On 2026-10-10, 1,066 IPv4 networks (/24 blocks) located in South Korea were flagged for malicious activity, with 2,762 listed IPv4 addresses. Each /24 counts once, however many of its addresses are listed.
- Which networks in South Korea host the most flagged IPs?
- KIXS-AS-KR-KR - Korea Telecom (AS4766, 828 networks), SKB-AS-KR - SK Broadband Co Ltd (AS9318, 46 networks), LGDACOM-KR - LG DACOM Corporation (AS3786, 36 networks). Large hosting providers appear because attackers rent their servers, not necessarily because of the operator.
Query this data per IP via the API
Look up threat categories, reputation score, ASN and geolocation for any address in South Korea or anywhere else with one API call.