45.95.186.232
45.95.186.232 is an IP address
that 3 published sources report
in connection with Kimsuky activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from AhnLab ASEC.
The earliest of those reports is dated 2026-03-31 and the most recent 2026-09-30.
ip address Kimsuky MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | HostPapa |
| Announced by | AS36352 HostPapa |
| Country | United States |
| Flags | hosting range |
Sources
-
…외부 서버에서 추가 페이로드를 내려받는 다운로더, 다른 하나는 공격자의 명령을 원격으로 수행하는 백도어이다. 3.1 백도어 백도어는 C2 서버인 45.95.186.232:8080 “HAPPY” 문자열을 가진 패킷을 전송한다.…
파이썬 기반 백도어를 유포하는 악성 LNK 및 유포 방식의 변화 (Kimsuky 그룹) - ASEC — AhnLab ASEC -
…Backdoor The backdoor sends packets with the string “HAPPY” to the C2 server, 45.95.186.232:8080.…
Malicious LNK Files Distributing a Python-Based Backdoor and Changes in Distribution Techniques (Kimsuky Group) - ASEC — AhnLab ASEC -
…2026) File name se.dwg se.dwg dog.dwg VERSION 1.1.8 1.1.8 4.4.3 HOSTS 45.95.186.232:80 45.43.60.53:80 70.36.97.236:443 TAG {Specific Identifier} {Name of Company Damaged} {Name of…
From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases - ASEC — AhnLab ASEC
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.