`5.9.123.217`

5.9.123.217 is an IP address that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians. The earliest of those reports is dated 2024-05-10 and the most recent 2024-06-05.

ip address Kimsuky MATCHED IN SOURCE

First seen 2024-05-10 · last seen 2024-06-05

Network

Kind	data centre
Network	Hetzner Online GmbH (Hetzner)
Announced by	AS24940 Hetzner Online GmbH
Country	Germany
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…46.252.150.82 [IT] brandwizer.co.in/green_pad/wp-content/plugins/custom-post-type-maker/essay/ d.php?na=battmp 5.9.123.217 [DE] 안랩 (Ahnlab) joongang.site/pprb/sec/ d.php?na=battmp 162.0.209.27 [US] 센티넬원 (Sentinelone) rfa.ink/bio/…
외신 인터뷰 의뢰 사칭 김수키 공격 발견 — Genians · under “3. 악성 파일 분석 (Malware Analysis)” · published 2024-06-05 · pulled 2026-09-12
…해당 도메인은 인도의 whiteserver 호스팅 업체에서 등록됐고, 아이피 주소는 독일소재의 '5.9.123.217' 주소로 연결돼 있습니다. < Tasks > < Task Type = "CommandLine" Command = "cmd.exe" > < String Name = "Name" ID = "5" /> < String…
페이스북과 MS관리콘솔을 활용한 Kimsuky APT 공격 발견 — Genians · under “3. 악성 파일 분석 (Malware Analysis)” · published 2024-05-10 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: 외신 인터뷰 의뢰 사칭 김수키 공격 발견

Genians lists 9 other indicators in this source. 7 are shown, chosen across types.

All 10 indicators from this source

Cited by the same report: 페이스북과 MS관리콘솔을 활용한 Kimsuky APT 공격 발견

Genians lists 12 other indicators in this source. 5 are shown, chosen across types.

All 13 indicators from this source