`185.21.14.249`

185.21.14.249 is an IP address that 2 published sources report in connection with Konni activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians. The reports are dated 2026-03-15.

ip address Konni MATCHED IN SOURCE

First seen 2026-03-15 · last seen 2026-03-15

Network

Kind	proxy or VPN
Network	Servers Tech Fzco
Announced by	AS216071 SERVERS TECH FZCO
Country	The Netherlands
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

…"185.21.14.249" [NL] One of EndRAT’s defining characteristics is that it uses a custom socket protocol over HTTP port 80 without actually…
Analysis of the Spear-Phishing and KakaoTalk-Linked Threat Campaign by the Konni Group — Genians · under “4-3. Analysis of the Malicious AutoIt Script” · published 2026-03-15 · pulled 2026-09-11
…"185.21.14.249" [NL] EndRat의 대표적인 특징 중 하나는 HTTP 포트(80)를 사용하면서도 실제 HTTP 프로토콜을 사용하지 않는 Custom Socket Protocol 구조입니다.…
Konni 그룹의 스피어피싱·카카오톡 연계 위협 캠페인 분석 — Genians · under “4-3. 악성 오토잇 스크립트 분석” · published 2026-03-15 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Analysis of the Spear-Phishing and KakaoTalk-Linked Threat Campaign by the Konni Group

Genians lists 10 other indicators in this source. 7 are shown, chosen across types.

All 11 indicators from this source

Cited by the same report: Konni 그룹의 스피어피싱·카카오톡 연계 위협 캠페인 분석

Genians lists 10 other indicators in this source. 3 are shown, chosen across types.

All 11 indicators from this source