← All actor clusters

79.133.56.173

79.133.56.173 is an IP address that 2 published sources report in connection with Konni and Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians and Rewterz. The earliest of those reports is dated 2024-09-05 and the most recent 2024-11-01.

ip address KonniKimsuky MATCHED IN SOURCE

First seen 2024-09-05 · last seen 2024-11-01

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …11 애니챗_20240511.xlsx.lnk 79.133.56.173 [DE] f1b542971711bf229d02f5e385225a8d 05.…

  코니(Konni) 위협 세계관의 확장 분석 리포트 — Genians · under “4. 악성 파일 분석 (Malware Analysis)” · published 2024-09-05 · pulled 2026-09-12

• …Impact Data Theft and Espionage Sensitive Data Exposure Indicators of Compromise Domain Name radiofreeasia.blog rfa.lol IP 79.133.56.173 MD5 f1b542971711bf229d02f5e385225a8d SHA-256 ae4dc41b8f5664b5aef5d82be55624d53be4ead0a23b029ae290e02c8d5f9e4f SHA1…

  North Korean APT Kimsuky aka Black Banshee - Active IOCs - Rewterz — Rewterz · under “IP” · published 2024-11-01 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: 코니(Konni) 위협 세계관의 확장 분석 리포트

Genians lists 11 other indicators in this source. 7 are shown, chosen across types.

• 0993cf18121be84f5b1511318df80f44 file hash
• 4638e7c17057fef4613af1f0f6821702 file hash
• 914eb1b37d5679931fc9c2b5f3a2bbcd file hash
• a0d332a95e2f42a7f26dd452c63938a4 file hash
• 185.176.43.108 IP address
• 192.186.3.160 IP address
• 216.107.137.73 IP address

All 12 indicators from this source

Cited by the same report: North Korean APT Kimsuky aka Black Banshee - Active IOCs - Rewterz

Rewterz lists 3 other indicators in this source.

• 67495e04457f66065470ab96c88d55e4ec3bf51e file hash
• ae4dc41b8f5664b5aef5d82be55624d53be4ead0a23b029ae290e02c8d5f9e4f file hash
• f1b542971711bf229d02f5e385225a8d file hash