`37.120.210.2`

37.120.210.2 is an IP address that 5 published sources report in connection with APT37, IT Worker Fraud and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians, Kudelski Security, Recorded Future and Spur. The earliest of those reports is dated 2024-12-19 and the most recent 2026-10-18.

ip address APT37 IT Worker Fraud Contagious Interview MATCHED IN SOURCE

First seen 2024-12-19 · last seen 2026-10-18

Network

Kind	Astrill VPN exit address
Network	M247 Europe SRL (M247 LTD)
Announced by	AS9009 M247 Europe SRL
Country	Japan
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This address is on Spur’s list of Astrill VPN exits. It names the VPN, not the user.

Sources

…C2 89.147.101.65 89.147.101.71 37.120.210.2…
Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation. ToyBox Story) — Genians · under “C2” · published 2025-05-12 · pulled 2026-09-11
…named "ATTACK (ATTACK_O)" 77.247.126.189 Clouvider VPS, USA Public IP related to the Bybit attack Operator H "YuHang team" 37.120.210.2 M247, Japan (linked with Mullvad VPN) Public IP related to APT 37 Operator I Team 313 Public IP related to contagious…
Inside the Cyber Infrastructure Behind DPRK Fake IT Worker Operations - Kudelski Security Research Center — Kudelski Security · under “Infrastructure assessment” · published 2026-03-23 · pulled 2026-09-12
…C2 89.147.101.65 89.147.101.71 37.120.210.2…
한국 국가안보전략 싱크탱크 위장 APT37 공격 사례 분석 (작전명. 토이박스 스토리) — Genians · under “C2” · published 2025-05-12 · pulled 2026-09-12
…4 23.104.209.6 23.106.161.1 23.106.169.120 23.160.56.155 23.228.120.12 23.237.33.110 23.237.102.130 31.7.63.94 37.120.151.162 37.120.154.98 37.120.210.2 38.170.181.10 38.246.149.2 38.32.68.195 38.75.136.211 38.75.137.97 38.75.137.213 43.230.201.57 43.230.201.68 45.126.210.144 45.145.68.10 45…
PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix C: Astrill VPN Nodes” · published 2026-01-21 · pulled 2026-09-12
These are the exit addresses of a commercial VPN service with customers everywhere. An address on this list says that a connection came through Astrill, which DPRK IT workers are documented to favour; it does not say who was behind the connection, and the great majority of traffic through these exits is ordinary customers. Treat a match as a reason to look at the account behind it, not as evidence about the person. The list is a snapshot of the addresses active on 19 December 2024; VPN exits are reassigned over time, so an address here may since have been returned to its hosting provider and given to someone else. The list is Spur's and is carried here as published.
Astrill VPN and DPRK Remote Worker Fraud — Spur · published 2024-12-19 · pulled 2026-10-26

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation. ToyBox Story)

Genians lists 21 other indicators in this source. 5 are shown, chosen across types.

All 22 indicators from this source

Cited by the same report: Inside the Cyber Infrastructure Behind DPRK Fake IT Worker Operations - Kudelski Security Research Center

Kudelski Security lists 3 other indicators in this source.

Cited by the same report: 한국 국가안보전략 싱크탱크 위장 APT37 공격 사례 분석 (작전명. 토이박스 스토리)

Genians lists 20 other indicators in this source. 4 are shown, chosen across types.

All 21 indicators from this source