`130.94.29.111`

130.94.29.111 is an IP address that one published source reports in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Break Glass Intelligence. The report is dated 2026-04-11.

ip address Kimsuky MATCHED IN SOURCE

First seen 2026-04-11 · last seen 2026-04-11

Network

Kind	proxy or VPN
Network	Light Node Limited
Announced by	AS154177 LIGHT NODE LIMITED
Country	South Korea
Flags	known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Source

…to Win64/PHP 8.2 while preserving the "Million OK !!!!" beacon signature If you've already published reporting on nid-log.com , the 130.94.29.111 cluster, or the bootservice.php payload source, please reply or DM — we'll update and credit. The Kill Chain On April 10, 2026 ,…
We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger — Break Glass Intelligence · under “What this report adds to the public record” · published 2026-04-11 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger

Break Glass Intelligence lists 9 other indicators in this source.