`208.67.222.220`

208.67.222.220 is an IP address that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from IIJ Security Diary and wezard4u. The earliest of those reports is dated 2025-09-02 and the most recent 2026-03-17.

ip address Kimsuky MATCHED IN SOURCE

First seen 2025-09-02 · last seen 2026-03-17

Network

Kind	data centre
Network	Cisco OpenDNS, LLC
Announced by	AS36692 Cisco OpenDNS, LLC
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…図3: クライアントIDを生成している処理次に各種システム情報 (ドメイン、ユーザ名、OSバージョン、プロセス一覧など) を収集します。この際、コマンド nslookup myip.opendns.com 208.67.222.220 を実行して、OpenDNSを使用してグローバルIPアドレス情報を収集します 3 。収集された情報は [System.IO.Path]::GetTempFileName() 関数を使用して一時ファイル内に保存されます。図4: システム情報を収集している処理…
Dropbox APIを使用するKimsukyのマルウェア – IIJ Security Diary — IIJ Security Diary · under “www.ps1” · published 2026-03-17 · pulled 2026-09-11
…= Get-Process $ooosss = [System.Environment]::OSVersion $iip = ((& "nslookup" "myip.opendns.com" "208.67.222.220") |select -last 2)[0].Trim("Addre(s)s:").Trim() $aaav = Get-CimInstance -Names(p)ace root/Sec(u)rityCenter2 -ClassName…
김수키(Kimsuky) 외교광장.ps1 악성코드 분석 및 보안 수칙 ESET 탐지 PowerShell/Kimsuky.AX — wezard4u · under “악성 PowerShell 코드” · published 2025-09-02 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.