← All actor clusters

80.71.157.55

80.71.157.55 is an IP address that 3 published sources report in connection with Kimsuky and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cisco Talos, ENKI and Cisco Talos (GitHub IOC repository). The earliest of those reports is dated 2024-08-21 and the most recent 2026-10-18.

ip address KimsukyDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2024-08-21 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …The new MoonPeak C2 server was also accessed by the attackers using RDP (port 3389) using two other remote IP addresses – 80.71.157.55 and 95.164.86.148 during the time it was under UAT-5394's control.…

  MoonPeak malware from North Korean actors unveils new details on attacker infrastructure — Cisco Talos · under “A pivotal server - 167.88.173.173” · published 2024-08-21 · pulled 2026-09-12

• …이는 공격자가 업로드한 테스트 로그 파일로 보이며, 공격자가 사설 ip와 공인 ip를 바꿔가며 파일 업로드를 테스트한 것을 확인하였다. 10.7.185.68 10.33.77.174 80.71.157.55 158.247.253.215 192.168.35.35 3.1.3.…

  Github를 공격 인프라로 악용하는 Kimsuky의 최신 국내 공격 사례 분석 — ENKI · under “3.1.2. /log 폴더” · published 2025-06-19 · pulled 2026-09-12

• …27202534cc03a398308475146f6710b790aa31361931d4fe1b495c31c3ed54f7 Network IOCs 167.88.173.173 95.164.86.148 80.71.157.55 84.247.179.77 45.87.153.79 45.95.11.52 104.194.152.251 yoiroyse.store pumaria.store 27.255.81.118 212.224.107.244 27.255.80.162…

  MoonPeak infrastructure (North Korea) — Cisco Talos (GitHub IOC repository) · published 2024-08-21 · pulled 2026-09-29

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: MoonPeak malware from North Korean actors unveils new details on attacker infrastructure

Cisco Talos lists 12 other indicators in this source. 5 are shown, chosen across types.

• 104.194.152.251 IP address
• 159.100.29.122 IP address
• 84.247.179.77 IP address
• 91.194.161.109 IP address
• 95.164.86.148 IP address

All 13 indicators from this source

Cited by the same report: Github를 공격 인프라로 악용하는 Kimsuky의 최신 국내 공격 사례 분석

ENKI lists 40 other indicators in this source. 4 are shown, chosen across types.

• janman8907@gmail.com email address
• 6cbc007799b56682ac196e44d79e496d file hash
• 74b1d5f857a4245aef8189ac4f409a99 file hash
• 101.36.114.190 IP address

All 41 indicators from this source

Cited by the same report: MoonPeak infrastructure (North Korea)

Cisco Talos (GitHub IOC repository) lists 36 other indicators in this source. 3 are shown, chosen across types.

• 3e39fc595db9db1706828b0791161440dc1571eaa07b523df9b721ad65e2369b file hash
• 4108c5096a62c0a6664eed781c39bb042eb0adf166fcc5d64d7c89139d525d4f file hash
• 41d4f7734fbf14ebcdf63f51093718fd5a22ec38a297c0dc3d7704a3fb48b3f9 file hash

All 37 indicators from this source