← All actor clusters

158.247.249.129

158.247.249.129 is an IP address that one published source reports in connection with APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians. The report is dated 2024-11-05.

ip address APT37 MATCHED IN SOURCE

First seen 2024-11-05 · last seen 2024-11-05

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …Galaxy에서 보냄 첨부파일명 북한동향.docx 북한사이버테러강의자료.pptx 공격 전략 lnk 바로가기 악성파일 전달 정상 pptx 문서 전달 명령제어(C2) navarar.com N/A 158.247.249.129 [KR] N/A [표 1] 이메일 내용 비교 ○ 발신지 아이피 뿐만 아니라, 이메일 본문 표현도 동일한 부분이 사용됐습니다.…

  APT37 위협 배후의 사이버 정찰 활동 분석 — Genians · under “4. 정찰 시나리오 (Recon Scenario)” · published 2024-11-05 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: APT37 위협 배후의 사이버 정찰 활동 분석

Genians lists 17 other indicators in this source. 12 are shown, chosen across types.

• sandozmessi@gmail.com email address
• 105ecd9f6585df4e1fe267c2809ee190 file hash
• 5f6682ad9da4590cba106e2f1a8cbe26 file hash
• 7a66738cca9f86f4133415eedcbf8e88 file hash
• 108.181.50.58 IP address
• 108.181.52.169 IP address
• 108.181.52.229 IP address
• 108.181.52.231 IP address
• 108.181.52.234 IP address
• 175.214.194.61 IP address
• 223.104.236.114 IP address
• 61.97.243.2 IP address

All 18 indicators from this source