← All actor clusters

156.154.132.200

156.154.132.200 is an IP address that one published source reports in connection with APT38, Kimsuky and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Darkatlas. The report is dated 2025-06-23.

ip address APT38KimsukyDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2025-06-23 · last seen 2025-06-23

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …structural and thematic resemblance to domains previously resolved By pivoting on each domain we got another 4 IPs 140.82.20.246 156.154.132.200 198.57.247.218 192.64.119.169 140.82.20.246 > 10/94 detection 156.154.132.200 > 2/94 detection 198.57.247.218 >…

  Bluenoroff (APT38) Live Infrastructure Hunting — Darkatlas · under “Initial Pivot” · published 2025-06-23 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Bluenoroff (APT38) Live Infrastructure Hunting

Darkatlas lists 8 other indicators in this source.

• dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980 file hash
• 104.168.136.24 IP address
• 104.168.151.116 IP address
• 140.82.20.246 IP address
• 192.119.116.231 IP address
• 192.64.119.169 IP address
• 198.54.117.242 IP address
• 198.57.247.218 IP address