27.102.138.163
Classification: Malicious
27.102.138.163 is a malicious IP address in Seoul, KR. Linked to Kimsuky activity. 453 sightings from 7 threat sources (Bruteforce), last seen 2026-11-06.
Current activity
- Known attacker — Seen launching attacks over the Internet.
- Open proxy — Provides anonymization that can hide an attacker.
MITRE ATT&CK associations
Intrusion sets: KIMSUKY (G0094)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Proxy | FireHOL | 2026-10-22 20:34:47 | 2026-11-06 20:32:18 | anomalous-activity anonymization proxy | |
| Anonymizer | FireHOL | 2026-10-22 19:35:18 | 2026-11-06 19:33:57 | anomalous-activity anonymization | |
| ET CINS Active Threat Intelligence Poor Reputation IP UDP | Emerging Threats | 2026-10-29 11:04:19 | 2026-11-06 11:03:20 | malicious-activity | |
| ET CINS Active Threat Intelligence Poor Reputation IP TCP | Emerging Threats | 2026-10-29 11:04:18 | 2026-11-06 11:03:18 | malicious-activity | |
| Malicious Host | CIArmy | 2026-10-27 20:00:37 | 2026-11-04 20:00:08 | attacker malicious-activity | |
| Kimsuky | MalwarePatrol | 2026-03-03 17:32:04 | 2026-03-03 18:01:41 | malicious-activity | G0094 Kimsuky |
| Kimsuky | ThreatFox Abuse.ch | 2025-08-25 08:14:59 | 2025-09-25 07:17:06 | malicious-activity | G0094 Kimsuky |
| Malicious Host | AbuseIPDB | 2025-06-10 21:13:48 | 2025-06-14 20:07:47 | attacker malicious-activity | |
| SSH Attacker | Blocklist.de | 2025-06-10 09:05:04 | 2025-06-13 03:59:35 | attacker malicious-activity | |
| Port Scanner | AbuseIPDB | 2025-06-09 17:20:13 | 2025-06-13 00:01:34 | anomalous-activity reconnaissance | |
| Bruteforce | AbuseIPDB | 2025-06-06 11:46:59 | 2025-06-13 00:01:34 | attacker malicious-activity | |
| SSH Attacker | AbuseIPDB | 2025-06-06 11:46:59 | 2025-06-13 00:01:34 | attacker malicious-activity | |
| Suspicious Host | AbuseIPDB | 2025-06-10 01:49:27 | 2025-06-10 01:49:27 | anomalous-activity |
Tags
ssh bruteforce bot port:80 shodan kimsuky c2 port:443 urlquery black banshee g0086 velvet chollima operation stolen pencil sparkling pisces thallium tor-node anonymizationWhois information
- AS name
- AS45996 DAOU TECHNOLOGY
- Registrant
- DAOU TECHNOLOGY
- City
- Seoul
- Postal code
- 04524
- Country
- KR — Korea, Republic of 🇰🇷
- First indexed
- 2025-06-10 03:41:45
- Last updated
- 2026-11-06 20:32:18