← All actor clusters

173.248.170.149

173.248.170.149 is an IP address that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from ESTsecurity ALYac and Arbornetworks. The earliest of those reports is dated 2018-12-05 and the most recent 2019-05-13.

ip address Kimsuky MATCHED IN SOURCE

First seen 2018-12-05 · last seen 2019-05-13

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …[그림 7] rrrr.pdb 화면 'cow.gif' 파일의 경우에는 중국어로 빌드된 악성 Dll 파일인데, PCRat 원격제어 프로그램의 'Server.dll' 파일 기능을 수행하게 되며, '173.248.170.149' 서버로 통신을 시도하게 됩니다.…

  암호화된 APT 공격, Kimsuky 조직의 '스모크 스크린' PART 2 — ESTsecurity ALYac · under “본문” · published 2019-05-13 · pulled 2026-09-12

• …us tempdomain8899.com world-paper.net zwfaxi.com IPs: 104.148.109.48 107.175.130.191 132.148.240.198 134.73.90.114 172.81.132.211 173.248.170.149 5.196.169.223 74.208.247.127 92.222.212.0 Share this: Tweet Share on Tumblr Related Posted in…

  STOLEN PENCIL Campaign Targets Academia — Arbornetworks · under “IOCs” · published 2018-12-05 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: 암호화된 APT 공격, Kimsuky 조직의 '스모크 스크린' PART 2

ESTsecurity ALYac lists 2 other indicators in this source.

• 0e595fb4462e99f392d441d960f8bc93 file hash
• d264875dab332d3475b99461310d7fff file hash

Cited by the same report: STOLEN PENCIL Campaign Targets Academia

Arbornetworks lists 7 other indicators in this source.

• 104.148.109.48 IP address
• 107.175.130.191 IP address
• 132.148.240.198 IP address
• 134.73.90.114 IP address
• 172.81.132.211 IP address
• 5.196.169.223 IP address
• 74.208.247.127 IP address