`185.194.178.6`

185.194.178.6 is an IP address that one published source reports in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Siddhant. The report is dated 2025-09-30.

ip address Kimsuky MATCHED IN SOURCE

First seen 2025-09-30 · last seen 2025-09-30

Network

Kind	proxy or VPN
Network	velia.net Internetdienste GmbH (Rackmarkt SL)
Announced by	AS29066 velia.net Internetdienste GmbH
Country	France
Flags	known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Source

…IPs, particularly looking for common PHP framework vulnerabilities: [Thu May 22 01:38:17.690879 2025] [php7:error] [pid 3432461] [client 185.194.178.6:20373] script ‘/var/www/html/_phpinfo.php’ not found or unable to stat [Thu May 22 01:38:18.515014 2025] [php7:error] [pid 3432462]…
Kimsuky/APT43 Phishing Infrastructure: A Technical Evolution — Siddhant · under “Phase 4: Deployment (May 17–23, 2025)” · published 2025-09-30 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Kimsuky/APT43 Phishing Infrastructure: A Technical Evolution

Siddhant lists 12 other indicators in this source.