← All actor clusters

5.75.181.118

5.75.181.118 is an IP address that one published source reports in connection with Konni activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians. The report is dated 2024-07-31.

ip address Konni MATCHED IN SOURCE

First seen 2024-07-31 · last seen 2024-07-31

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …그리고 C2 서버 '5.75.181.118 [DE]' 주소로 접속해 추가 명령을 대기 합니다. ○ 악성 코드 내부 Dialog 문자열에는 'RFTServer, Version 1.0' 표현이 포함돼 있으며, 이런 종류의 악성 파일 시리즈는 'RftRAT' 이름으로 명명돼 있습니다.…

  AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석 — Genians · under “4. 침해 사고 조사 (Breach Incident Investigation)” · published 2024-07-31 · pulled 2026-09-11

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석

Genians lists 12 other indicators in this source.

• no-reply.trustmaster@hometax.go.kr email address
• 16eb2cceb920319eaddd5d7b85483cc4 file hash
• 61f65bd593ea0e52ac0dfdc6bc9cd73a file hash
• 87dc4c8f67cffc8a9699328face923e2 file hash
• 162.241.216.224 IP address
• 162.241.253.27 IP address
• 185.231.154.22 IP address
• 5.161.182.109 IP address
• 5.78.68.117 IP address
• 62.113.118.157 IP address
• 93.183.93.185 IP address
• 94.103.87.212 IP address