← All actor clusters

144.172.106.66

144.172.106.66 is an IP address that one published source reports in connection with APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Zscaler. The report is dated 2026-02-26.

ip address APT37 MATCHED IN SOURCE

First seen 2026-02-26 · last seen 2026-02-26

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …Description philion.store THUMBSBD C2 homeatedke.store THUMBSBD C2 hightkdhe.store THUMBSBD C2 144.172.106.66:8080 FOOTWINE C2 MITRE ATT&CK Framework ID Technique Name Annotation T1204.001 User Execution:…

  APT37 Ruby Jumper: Air-Gap Attack via Removable Media — Zscaler · under “Network indicators” · published 2026-02-26 · pulled 2026-09-11

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.