`185.176.43.106`

185.176.43.106 is an IP address that 2 published sources report in connection with Kimsuky and Konni activity, which public reporting attributes to North Korea (DPRK). It is cited here from ESTsecurity ALYac and Securonix. The earliest of those reports is dated 2022-07-20 and the most recent 2022-08-26.

ip address Kimsuky Konni MATCHED IN SOURCE

First seen 2022-07-20 · last seen 2022-08-26

Network

Kind	data centre
Network	ZETTA
Announced by	AS44476 ZETTA HOSTING SOLUTIONS LLC.
Country	Bulgaria
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…IoC http://gg1593.c1.biz/dn.php 185.176.43.106 DAE0EFD29230FEAB95F46EE20030A425 공유하기 게시글 관리 이스트시큐리티 알약 블로그 저작자표시 비영리 변경금지 (새창열림)…
김수키(Kimsuky) 그룹, 러시아 외무부를 타겟으로 공격 진행중! — ESTsecurity ALYac · under “본문” · published 2022-08-26 · pulled 2026-09-12
…Automated Exfiltrated T1041 Exfiltration Over C2 Channel STIFF#BIZON – Indicators of compromise Host Communication 185.176.43.106 547857.c1.biz 65487.c1.biz File Name SHA256 (Dynamic/Custom implants) food.bat…
STIFF#BIZON Detection Using Securonix – New Attack Campaign Observed Possibly Linked to Konni/APT37 (North Korea) — Securonix · under “STIFF#BIZON – Indicators of compromise” · published 2022-07-20 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: STIFF#BIZON Detection Using Securonix – New Attack Campaign Observed Possibly Linked to Konni/APT37 (North Korea)

Securonix lists 8 other indicators in this source.