`152.89.247.26`

152.89.247.26 is an IP address that one published source reports in connection with Konni activity, which public reporting attributes to North Korea (DPRK). It is cited here from Lumen. The report is dated 2022-01-05.

ip address Konni MATCHED IN SOURCE

First seen 2022-01-05 · last seen 2022-01-05

Network

Kind	proxy or VPN
Network	aurologic GmbH (Aurologic Ffm1)
Announced by	AS30823 aurologic GmbH
Country	Germany
Flags	known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Source

…Black Lotus Labs team discovered a series of spoofed hostnames impersonating MID portals that all resolved to the same single IP address: 152.89.247.26.…
New Konni Campaign Kicks Off The New Year By Targeting Russian Ministry Of Foreign Affairs — Lumen · under “October 2021: Phishing for Initial Access” · published 2022-01-05 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.