Chollima Hunter

← All actor clusters

167.172.113.157

167.172.113.157 is an IP address that one published source reports in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from SentinelOne. The report is dated 2023-08-01.

ip address Kimsuky MATCHED IN SOURCE

First seen 2023-08-01 · last seen 2023-08-01

Network

Kinddata centre
NetworkDigitalOcean, LLC
Announced byAS14061 DigitalOcean, LLC
CountryUnited States
Flagshosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

  • …hp renaissancenft.io/wp-content/plugins/download-plugin/plugins.php stmwa.de/work/config/data.php csmss.org/admin/uploads/award/award28.php 167.172.113.157/ 108.179.214.134/ 174.138.30.233/ absolutemedia.net.au/ absolutemedia.net.au/testing/wp-content/intelmanagertools.exe absolutemedia.net.au/…
    Illicit Brand Impersonation | A Threat Hunting Approach | SentinelOne — SentinelOne · under “Reused Characteristics of Infrastructure – APTs” · published 2023-08-01 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Illicit Brand Impersonation | A Threat Hunting Approach | SentinelOne

SentinelOne lists 3 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.