`216.189.159.197`

216.189.159.197 is an IP address that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from S2W. The earliest of those reports is dated 2024-02-07 and the most recent 2024-02-08.

ip address Kimsuky MATCHED IN SOURCE

First seen 2024-02-07 · last seen 2024-02-08

Network

Kind	data centre
Network	HostUS
Announced by	AS7489 HostUS
Country	United States
Flags	hosting range

Looked up 2026-10-01 at ip-api.com. A hosting range is not evidence on its own.

Sources

…tem.co.kr/admin/mail/index.php ai.kostin.p-e.kr ar.kostin.p-e.kr ai.negapa.p-e.kr ol.negapa.p-e.kr ai.limsjo.p-e.kr qi.limsjo.p-e.kr 216.189.159.197 Kimsuky Troll Stealer Gpki -- -- Follow Written by…
Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer — S2W · under “Network” · published 2024-02-07 · pulled 2026-10-01
…tem.co.kr/admin/mail/index.php ai.kostin.p-e.kr ar.kostin.p-e.kr ai.negapa.p-e.kr ol.negapa.p-e.kr ai.limsjo.p-e.kr qi.limsjo.p-e.kr 216.189.159.197 Troll Stealer North Korea Kimsuky Gobear -- --…
Medium — S2W · under “Network” · published 2024-02-08 · pulled 2026-10-02

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer

S2W lists 3 other indicators in this source.

Cited by the same report: Medium

S2W lists 4 other indicators in this source. 3 are shown, chosen across types.

All 5 indicators from this source