`156.59.13.154`

156.59.13.154 is an IP address that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from ENKI. The reports are dated 2025-09-22.

ip address Kimsuky MATCHED IN SOURCE

First seen 2025-09-22 · last seen 2025-09-22

Network

Kind	data centre
Network	Zenlayer Inc
Announced by	AS21859 Zenlayer Inc
Country	Singapore
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…: "https" , "cpt" : 3717236 , "ratio" : 0.9976261922379036 , "versions" : { } } , { "attribute" : "x-real-ip" , "value" : "156.59.13.154" , "cpt" : 1 , "ratio" : 2.683784920402965e-7 , "versions" : { } } , { "attribute" : "x-forwarded-for" , "value" :…
In-Depth Analysis of the APT Down - The North Korea Files leak — ENKI · under “3.2.4. Other Artifacts” · published 2025-09-22 · pulled 2026-09-12
…, "value" : "https" , "cpt" : 3717236 , "ratio" : 0.9976261922379036 , "versions" : {} }, { "attribute" : "x-real-ip" , "value" : "156.59.13.154" , "cpt" : 1 , "ratio" : 2.683784920402965e-7, "versions" : {} }, { "attribute" : "x-forwarded-for" , "value" : "156.59.13.154" ,…
APT Down - The North Korea Files 공개 자료 상세 분석 보고서 — ENKI · under “3.2.4. etc” · published 2025-09-22 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: In-Depth Analysis of the APT Down - The North Korea Files leak

ENKI lists 6 other indicators in this source.