`45.133.194.126`

45.133.194.126 is an IP address that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from ENKI. The reports are dated 2025-09-22.

ip address Kimsuky MATCHED IN SOURCE

First seen 2025-09-22 · last seen 2025-09-22

Network

Kind	fixed line
Network	EstNOC OU (Estnoc OY)
Announced by	AS206804 EstNOC OU
Country	South Korea

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

…( work/mnt/hgfs/Desktop/New folder/forward.conf ), the phishing VPS IP is set to 45.133.194.88 . Currently, nid-security.com resolves to 45.133.194.126 , an IP in the same range as the one configured in forward.conf .…
In-Depth Analysis of the APT Down - The North Korea Files leak — ENKI · under “5.1.1. Operation Covert Stalker” · published 2025-09-22 · pulled 2026-09-12
…알 수 있는데, 피싱 VPS 서버 ip를 설정하는 파일( work/mnt/hgfs/Desktop/New folder/forward.conf )에서 ip는 45.133.194.88로 설정되어 있다. 현재 nid-security.com 도메인 ip는 45.133.194.126으로, work/mnt/hgfs/Desktop/New folder/forward.con 에서 확인한 ip(45.133.194.88)와 같은 대역대이다.…
APT Down - The North Korea Files 공개 자료 상세 분석 보고서 — ENKI · under “5.1.1. Operation Covert Stalker” · published 2025-09-22 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: In-Depth Analysis of the APT Down - The North Korea Files leak

ENKI lists 6 other indicators in this source.