`158.247.202.109`

158.247.202.109 is an IP address that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from ENKI. The earliest of those reports is dated 2025-06-19 and the most recent 2025-12-16.

ip address Kimsuky MATCHED IN SOURCE

First seen 2025-06-19 · last seen 2025-12-16

Network

Kind	data centre
Network	The Constant Company, LLC
Announced by	AS20473 The Constant Company, LLC
Country	South Korea
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…네이버 피싱 공격에 사용된 XenoRAT C&C 서버 추가로 확보한 XenoRAT(baf164d2a5066cab5772dc6ae4807f43) 중 C&C 서버 주소(158.247.202.109)는 네이버 피싱 사이트로 사용중이며, 북한 배후 공격 그룹인 Kimsuky가 사용하는 도메인 형식인 "p-e.kr"과 "Million OK!!!!" 문자열이 확인되었다. caption - C&C 서버 접속 시 나타나는 "Million…
Github를 공격 인프라로 악용하는 Kimsuky의 최신 국내 공격 사례 분석 — ENKI · under “6.3. 네이버 피싱 공격에 사용된 XenoRAT C&C 서버” · published 2025-06-19 · pulled 2026-09-12
…campaign with those from the current campaign. | Historical Naver phishing URL | Current Naver phishing URL | | --- | --- | | http : //158.247.202.109/invoice/?wreply=&m=https%3a%2f%2fnid.naver.com%2fnidlogin.login |…
Kimsuky Distributing Malicious Mobile App via QR Code — ENKI · under “4.1. Shared Infrastructure with the "Million OK !!!!" Phishing Campaign” · published 2025-12-16 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Github를 공격 인프라로 악용하는 Kimsuky의 최신 국내 공격 사례 분석

ENKI lists 40 other indicators in this source. 7 are shown, chosen across types.

All 41 indicators from this source

Cited by the same report: Kimsuky Distributing Malicious Mobile App via QR Code

ENKI lists 10 other indicators in this source. 5 are shown, chosen across types.

All 11 indicators from this source