158.247.219.150
158.247.219.150 is an IP address
that 2 published sources report
in connection with Kimsuky activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Break Glass Intelligence.
The earliest of those reports is dated 2026-04-03 and the most recent 2026-04-22.
ip address Kimsuky MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | The Constant Company, LLC |
| Announced by | AS20473 The Constant Company, LLC |
| Country | South Korea |
| Flags | hosting range |
Sources
-
…# Indicators of Compromise ## Primary IP ## Sequential Pattern ## Detection ## Hunt Queries When @skocherhan flagged 158.247.219.150 with a note about malicious sites on VirusTotal, we expected a shared hosting server with some bad tenants.…
850 Hostnames, 6 Servers, 1 Kill Chain: Mapping Kimsuky's 2026 Korean Credential Harvesting Machine — Break Glass Intelligence -
…documented a pattern of Vultr Seoul VPS abuse by actors consistent with the Kimsuky cluster — from the 740-hostname phishing factory on 158.247.219.150 , to the CHM/NidLog C2 payload recovery , to the Telegram bot and IPFS harvester cell , to the Udalyonka htdocs dump on 158.247.250.37…
A Third Vultr Seoul Box: 60+ Kimsuky Domains, 18 Months of DDNS Rotation, and a 5-Year Infrastructure Trail — Break Glass Intelligence
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.