`27.255.79.225`

27.255.79.225 is an IP address that 2 published sources report in connection with APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Lookout and PolySwarm. The earliest of those reports is dated 2025-03-12 and the most recent 2026-10-18.

ip address APT37 MATCHED IN SOURCE

First seen 2025-03-12 · last seen 2026-10-18

Network

Kind	data centre
Network	Hostcenter (Ehostict)
Announced by	AS45382 Hostcenter
Country	South Korea
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…One of the C2 domains of KoSpy, st0746.net, resolves 3 to the IP address 27.255.79.225 located in South Korea.…
Lookout Discovers North Korean APT37 Mobile Spyware — Lookout · under “Attribution” · published 2025-03-12 · pulled 2026-09-12
…The C2 domain st0746.net resolves to the IP 27.255.79.225 in South Korea, previously tied to domains like naverfiles.com and mailcorp.center, associated with the Konni RAT used by Ricochet…
Ricochet Chollima Using KoSpy Android Spyware — PolySwarm · under “KoSpy is a sophisticated Android spyware linked to North Korean threat actor Ricochet Chollima. It has been targeting Korean and English-speaking users since March 2022.” · published 2025-03-17 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Lookout Discovers North Korean APT37 Mobile Spyware

Lookout lists 6 other indicators in this source.