222.120.176.6 has a moderate threat confidence level of 53%, originating from Goyang-si, South Korea, on the Korea Telecom network (4766). It has been observed across 213 sessions targeting SSH, First observed on January 20, 2026, most recently active March 7, 2026.