`198.54.117.242`

198.54.117.242 is an IP address that 2 published sources report in connection with APT38, Kimsuky and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Darkatlas and Security Alliance. The earliest of those reports is dated 2025-06-23 and the most recent 2026-04-08.

ip address APT38 KimsukyDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2025-06-23 · last seen 2026-04-08

Network

Kind	proxy or VPN
Network	Namecheap (Web-hosting.com)
Announced by	AS22612 Namecheap, Inc.
Country	United States
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

…198.57.247.218 > 1/94 detection 192.64.119.169 > 0/94 detection this IP resolves bellezalatam.com 198.54.117.242 > 2/94 detection This IP resolves to amirani.chat The malware has been identified communicating with a known Command and…
Bluenoroff (APT38) Live Infrastructure Hunting — Darkatlas · under “Initial Pivot” · published 2025-06-23 · pulled 2026-09-12
…NAMECHEAP INC 163 join-uk.com 2020-01-27 00:57:20 198.54.117.242 22612 Namecheap, Inc.…
Advisory on DPRK (UNC1069) Fake Microsoft Teams and Zoom calls — Security Alliance · under “IOCs” · published 2026-04-08 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Bluenoroff (APT38) Live Infrastructure Hunting

Darkatlas lists 8 other indicators in this source. 7 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: Advisory on DPRK (UNC1069) Fake Microsoft Teams and Zoom calls

Security Alliance lists 72 other indicators in this source. 5 are shown, chosen across types.

All 73 indicators from this source