`211.239.117.117`

211.239.117.117 is an IP address that 2 published sources report in connection with APT37 and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from ESET and Dion Alexander. The earliest of those reports is dated 2025-04-13 and the most recent 2026-05-05.

ip address APT37 APT38 MATCHED IN SOURCE

First seen 2025-04-13 · last seen 2026-05-05

Network

Kind	data centre
Network	Hostway IDC (Sejong)
Announced by	AS9952 Hostway IDC
Country	South Korea
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…211.239.117.117 1980food.co.kr Hostway IDC 2025‑03‑07 Compromised South Korean site used to host Android BirdCall configuration.…
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack — ESET · under “Network” · published 2026-05-05 · pulled 2026-09-12
…of Compromise (IOCs) DNS Queries & HTTP Requests The malware made several DNS queries, including requests to www.addfriend.kr (IP: 211.239.117.117). Other domains contacted were mostly Microsoft services for system updates and certificate validation. C2 Communication & Exfiltration…
Unpacking APT38: Static and Dynamic Analysis of Lazarus Group Malware — Dion Alexander · under “DNS Queries & HTTP Requests” · published 2025-04-13 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: A rigged game: ScarCruft compromises gaming platform in a supply-chain attack

ESET lists 18 other indicators in this source. 7 are shown, chosen across types.

All 19 indicators from this source

Cited by the same report: Unpacking APT38: Static and Dynamic Analysis of Lazarus Group Malware

Dion Alexander lists 2 other indicators in this source.