← All actor clusters

192.119.116.231

192.119.116.231 is an IP address that 3 published sources report in connection with APT38, Kimsuky and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Darkatlas, Hunt.io and Huntabil. The earliest of those reports is dated 2025-04-23 and the most recent 2025-12-17.

ip address APT38KimsukyDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2025-04-23 · last seen 2025-12-17

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …phishing domains are structurally and thematically similar to those previously resolved by the initial IP address 104.168.151.116 . 192.119.116.231 > 1/94 detection The observed phishing domains show strong structural and thematic resemblance to domains previously resolved…

  Bluenoroff (APT38) Live Infrastructure Hunting — Darkatlas · under “Initial Pivot” · published 2025-06-23 · pulled 2026-09-12

• …malware WHERE ( ip = '104.168.198.145' OR ip = '23.254.164.50' OR ip = '192.236.146.20' OR ip = '142.11.209.109' OR ip = '192.119.116.231' OR ip = '192.236.233.162' OR ip = '192.236.176.164' OR ip = '192.236.236.100' OR ip = '192.236.146.22' OR ip = '23.254.128.114'…

  Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns — Hunt.io · under “Hunt #4 - Pivoting Into APT Lazarus Certificate” · published 2025-12-17 · pulled 2026-09-12

• …and gumi-cryptos.us05web-zoom.pro IP address 104.168.151.116 Resolved IP for firstfromsep.online IP Address 192.119.116.231 Resolved IP for firstfromsep.online IP Address 192.236.146.22 Resolved IP for writeup.live IP Address 142.11.241.62…

  North Korea Calling - Web3 Zoom Campaign — Huntabil · under “Indicators of Compromise (IOCs)” · published 2025-04-23 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Bluenoroff (APT38) Live Infrastructure Hunting

Darkatlas lists 8 other indicators in this source. 5 are shown, chosen across types.

• dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980 file hash
• 104.168.136.24 IP address
• 192.64.119.169 IP address
• 198.54.117.242 IP address
• 198.57.247.218 IP address

All 9 indicators from this source

Cited by the same report: Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns

Hunt.io lists 30 other indicators in this source. 4 are shown, chosen across types.

• AS135377 autonomous system number
• AS30377 autonomous system number
• bc7bd27e94e24a301edb3d3e7fad982225ac59430fc476bda4e1459faa1c1647 file hash
• 192.236.146.20 IP address

All 31 indicators from this source

Cited by the same report: North Korea Calling - Web3 Zoom Campaign

Huntabil lists 9 other indicators in this source. 3 are shown, chosen across types.

• 5fe5b1d879251d1618e275099cc63636d699a7f9b45176abe66283201b8ee877 file hash
• 803d5db6296a5829b168ae45087356f49255579afbcb58fb43c4fb8c3819da28 file hash
• 192.236.146.22 IP address

All 10 indicators from this source