← All actor clusters

139.99.36.158

139.99.36.158 is an IP address that one published source reports in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from ENKI. The report is dated 2025-06-19.

ip address Kimsuky MATCHED IN SOURCE

First seen 2025-06-19 · last seen 2025-06-19

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …/log 폴더 공격자 테스트 로그 파일만 존재하며, hole_311에서 확인되지 않은 새로운 ip 주소가 확인되었다. 80.71.157.55 139.99.36.158: 새로 확인된 ip 주소 158.247.253.215 4.…

  Github를 공격 인프라로 악용하는 Kimsuky의 최신 국내 공격 사례 분석 — ENKI · under “3.3.2. /log 폴더” · published 2025-06-19 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Github를 공격 인프라로 악용하는 Kimsuky의 최신 국내 공격 사례 분석

ENKI lists 40 other indicators in this source. 12 are shown, chosen across types.

• janman8907@gmail.com email address
• 1dee4c60fffcc80eb4bbd523eedab2f4 file hash
• 30d5f17d5e3f85be18220a7cab0b9fff file hash
• 45ed6abfc12be606bdbcfe76bd17b2af file hash
• 5076c579e378f976a57e862e5b6a7859 file hash
• 522a122f3cd4c488a51d81c846bfabbb file hash
• 57015267d06b0d80721015ccd29a04cd file hash
• 141.164.41.17 IP address
• 158.247.202.109 IP address
• 158.247.230.196 IP address
• 158.247.253.215 IP address
• 165.154.78.9 IP address

All 41 indicators from this source