← All actor clusters

104.168.136.24

104.168.136.24 is an IP address that one published source reports in connection with APT38, Kimsuky and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Darkatlas. The report is dated 2025-06-23.

ip address APT38KimsukyDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2025-06-23 · last seen 2025-06-23

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …resolves to amirani.chat The malware has been identified communicating with a known Command and Control (C2) server at IP address 104.168.136.24 . The malware sample : localfile~.x64 (SHA-256: dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980 ) has been…

  Bluenoroff (APT38) Live Infrastructure Hunting — Darkatlas · under “Initial Pivot” · published 2025-06-23 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Bluenoroff (APT38) Live Infrastructure Hunting

Darkatlas lists 8 other indicators in this source.

• dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980 file hash
• 104.168.151.116 IP address
• 140.82.20.246 IP address
• 156.154.132.200 IP address
• 192.119.116.231 IP address
• 192.64.119.169 IP address
• 198.54.117.242 IP address
• 198.57.247.218 IP address