← All actor clusters

121.254.222.10

121.254.222.10 is an IP address that 2 published sources report in connection with APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians. The reports are dated 2026-06-14.

ip address APT37 MATCHED IN SOURCE

First seen 2026-06-14 · last seen 2026-06-14

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• …b6b0602310bb2d4360c52685119aac1b C2 crwellfood.com daehoat.com fe01.co.kr novel21.co.kr webhostingkorea.com 121.254.222.10 121.254.222.80 211.239.157.126 218.150.78.198 218.150.78.231 61.100.9.206…

  Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2 — Genians · under “C2” · published 2026-06-14 · pulled 2026-09-11

• …b6b0602310bb2d4360c52685119aac1b C2 crwellfood.com daehoat.com fe01.co.kr novel21.co.kr webhostingkorea.com 121.254.222.10 121.254.222.80 211.239.157.126 218.150.78.198 218.150.78.231 61.100.9.206…

  MS 사칭 피싱과 Dead-drop C2 기반 APT37 NarwhalRAT 분석 — Genians · under “C2” · published 2026-06-14 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2

Genians lists 9 other indicators in this source. 7 are shown, chosen across types.

• 3715092aa00f380cefe8b4d2eddb7d08 file hash
• 7cef19f9c4480adac0cd4702ff98f46c file hash
• 7eb9cee1f696727752169f25cf79a338 file hash
• b6b0602310bb2d4360c52685119aac1b file hash
• 121.254.222.80 IP address
• 211.239.157.126 IP address
• 218.150.78.198 IP address

All 10 indicators from this source

Cited by the same report: MS 사칭 피싱과 Dead-drop C2 기반 APT37 NarwhalRAT 분석

Genians lists 9 other indicators in this source. 2 are shown, chosen across types.

• 218.150.78.231 IP address
• 61.100.9.206 IP address

All 10 indicators from this source