`157.250.202.123`

157.250.202.123 is an IP address that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from ENKI. The reports are dated 2026-05-27.

ip address Kimsuky MATCHED IN SOURCE

First seen 2026-05-27 · last seen 2026-05-27

Network

Kind	data centre
Network	Interserver, Inc
Announced by	AS26666 Interserver, Inc
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…2025년 11월 VirusTotal에 업로드된 recaptcha.html 은 당시 Kimsuky의 인프라로 확인되어 모니터링하던 157.250.202.123 에서 사용되었으며, 분석된 보안프로그램 확인.html 과 비교한 내용은 아래 표와 같다. | 파일명 | MD5 | 파라미터 | 로컬 서버 포트 | | --- | --- | --- | --- | | recaptcha .…
Kimsuky의 고도화된 공격 기법 분석: JSONPing, Webex 사칭, 그리고 새로운 HttpSpy 변종 — ENKI · under “6.2.2. 피싱 페이지의 callback 확인 루틴” · published 2026-05-27 · pulled 2026-09-12
…recaptcha.html , uploaded to VirusTotal in November 2025, was hosted on 157.250.202.123 , an IP we had been monitoring as known Kimsuky infrastructure.…
Kimsuky's Advanced Attack Techniques: JSONPing, Webex Spoofing, and a New HttpSpy Variant — ENKI · under “6.2.2. Callback Verification Routine in Phishing Pages” · published 2026-05-27 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Kimsuky의 고도화된 공격 기법 분석: JSONPing, Webex 사칭, 그리고 새로운 HttpSpy 변종

ENKI lists 3 other indicators in this source.

Cited by the same report: Kimsuky's Advanced Attack Techniques: JSONPing, Webex Spoofing, and a New HttpSpy Variant

ENKI lists 4 other indicators in this source. 1 are shown, chosen across types.

All 5 indicators from this source