`27.255.80.170`

27.255.80.170 is an IP address that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from ENKI. The reports are dated 2025-09-22.

ip address Kimsuky MATCHED IN SOURCE

First seen 2025-09-22 · last seen 2025-09-22

Network

Kind	data centre
Network	Hostcenter (EHOST)
Announced by	AS45382 Hostcenter
Country	South Korea
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…--manual --preferred-challenges dns-01 --server <https://acme-v02.api.letsencrypt.org/directory> In forward.conf, replace `Require ip 27.255.80.170` with the phishing VPS address In default-ssl.conf, replace `/etc/letsencrypt/live/nid-security.com/` with the path to your own generated…
In-Depth Analysis of the APT Down - The North Korea Files leak — ENKI · under “1.5.1. Naver AitM Attack” · published 2025-09-22 · pulled 2026-09-12
…해당 도메인은 2024년 11월 5일에 안랩 Operation Covert Stalker 보고서 에서 언급된 ip(27.255.80.170)와 연결된 이력이 있고, 이 ip는 work/mnt/hgfs/Desktop/New folder/readme.txt 에서 확인할 수 있다. readme.txt를 보면 ip(27.255.80.170)를 "피싱 VPS 주소"로 변경하라는 것을 알 수…
APT Down - The North Korea Files 공개 자료 상세 분석 보고서 — ENKI · under “5.1.1. Operation Covert Stalker” · published 2025-09-22 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: In-Depth Analysis of the APT Down - The North Korea Files leak

ENKI lists 6 other indicators in this source.