HIDDEN COBRA: IP Addresses Suggested for Blocking (2017)

DFS Suggested IPs to Block HIDDEN COBRA

199.68.196.125
103.16.223.35
113.28.244.194
116.48.145.179
186.116.9.20
186.149.198.172
195.28.91.232
195.97.97.148
199.15.234.120
200.42.69.133
203.131.222.99
210.187.87.181
83.231.204.157
84.232.224.218
89.190.188.42
109.68.120.179
85.132.123.50
80.95.219.72
88.201.64.185
103.10.55.35
45.124.169.36
222.44.80.138
61.153.146.207
41.131.164.156
82.129.240.148
82.201.131.124
31.146.82.22
103.27.164.10
103.27.164.42
112.133.214.38
114.79.141.59
115.115.174.67
115.178.96.66
115.249.29.0/24
117.211.164.0/24
117.218.84.0/24
117.239.102.0/24
117.239.144.0/24
117.240.190.0/24
117.247.63.0/24
117.247.8.0/24
118.67.237.0/24
125.17.79.0/24
125.18.9.0/24
14.102.46.0/24
14.139.125.0/24
14.141.129.0/24
180.211.97.0/24
182.156.76.0/24
182.72.113.0/24
182.73.165.0/24
182.73.245.0/24
182.74.42.0/24
182.77.61.0/24
183.82.199.0/24
183.82.33.0/24
203.110.91.0/24
203.196.136.0/24
203.88.138.0/24
43.249.216.0/24
45.118.34.0/24
139.255.62.0/24
128.65.184.0/24
128.65.187.0/24
178.248.41.0/24
185.113.149.0/24
185.115.164.0/24
185.46.218.0/24
213.207.209.0/24
217.218.90.0/24
217.219.193.0/24
217.219.202.0/24
37.235.21.0/24
37.98.114.0/24
78.38.114.0/24
78.38.182.0/24
78.39.125.0/24
80.191.171.0/24
85.185.30.0/24
85.9.74.0/24
89.165.119.0/24
91.106.77.0/24
91.98.112.0/24
91.98.126.0/24
91.98.36.0/24
94.183.177.0/24
95.38.16.0/24
27.114.187.0/24
116.90.226.0/24
113.203.238.0/24
115.186.133.0/24
182.176.121.0/24
182.187.139.0/24
37.216.67.0/24
84.235.85.0/24
103.241.106.0/24
203.118.42.0/24
58.185.197.0/24
123.231.112.0/24
222.165.146.0/24
122.146.157.0/24
140.136.205.0/24
110.77.137.0/24
118.175.22.0/24
125.25.206.0/24
203.147.10.0/24
58.82.155.0/24
61.91.47.0/24
185.134.98.0/24
125.212.132.0/24
175.100.189.0/24
81.0.213.0/24
98.101.211.0/24
181.119.19.0/24
190.105.225.0/24
41.92.208.0/24
209.183.21.0/24
190.82.74.0/24
190.82.86.0/24
111.207.78.0/24
119.10.74.0/24
122.114.89.0/24
122.114.94.0/24
139.217.27.0/24
221.208.194.0/24
221.235.53.0/24
77.78.100.0/24
81.0.213.0/24
62.243.45.0/24
117.232.100.0/24
59.90.93.0/24
125.160.213.0/24
27.123.221.0/24
36.71.90.0/24
191.233.33.0/24
200.57.90.0/24
5.79.99.0/24
203.160.191.0/24
196.25.89.0/24
82.223.213.0/24
82.223.73.0/24
91.116.139.0/24
195.74.38.0/24
210.202.40.0/24
104.192.193.0/24
173.0.129.0/24
173.0.129.0/24
191.234.40.0/24
199.167.100.0/24
208.180.64.0/24
208.78.33.0/24
216.163.20.0/24
50.62.168.0/24
64.29.144.0/24
66.175.41.0/24
66.232.121.0/24
66.242.128.0/24
71.125.1.0/24
72.167.53.0/24
75.103.110.0/24
96.65.90.0/24
98.101.211.0/24
98.113.84.0/24
98.159.16.0/24
197.211.212.0/24

Updated November 2026: the original post is kept above; the sections below add context for readers today.

What this list was

HIDDEN COBRA is the name the US government used for malicious cyber activity by the North Korean government. In November 2017, US-CERT published alerts on two HIDDEN COBRA tools, the FALLCHILL remote access trojan and the Volgmer backdoor, with lists of IP addresses tied to them. The addresses above were shared with financial institutions as suggested blocks at that time.

Should you block these addresses today?

Not as a fixed list. IP addresses change hands; many on a 2017 list now belong to unrelated, legitimate organizations, and blocking whole ranges can break business traffic. Indicator lists are useful for a short time and should come with an expiry date.

• Use a maintained threat intelligence feed in your firewall or SIEM, with automatic updates.
• Follow current CISA advisories, which replaced US-CERT alerts in 2018.
• Search past logs for matches when a new advisory appears.

Digital Edge SOC and LogIT apply current indicators automatically.