`54.251.107.25`

54.251.107.25 is an IP address that one published source reports in connection with APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kaspersky. The report is dated 2017-08-25.

ip address APT37 MATCHED IN SOURCE

First seen 2017-08-25 · last seen 2017-08-25

Network

Kind	data centre
Network	Amazon.com, Inc. (AWS EC2 (ap-southeast-1))
Announced by	AS16509 Amazon.com, Inc.
Country	Singapore
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

…the IP value with the key 0x186BFB49. The following is an example using the default hostname, download.ns360.info: orig IP resolution: 54.251.107.25= 36 FB 6B 19 = 196BFB36 xored: 127.0.0.1 = 7F 00 00 01 = 0100007F The following is an example of the default URL with an added number,…
WALKING IN YOUR ENEMY’S SHADOW: WHEN FOURTH-PARTY COLLECTION BECOMES ATTRIBUTION HELL — Kaspersky · published 2017-08-25 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: WALKING IN YOUR ENEMY’S SHADOW: WHEN FOURTH-PARTY COLLECTION BECOMES ATTRIBUTION HELL

Kaspersky lists 4 other indicators in this source.