104.168.137.21
104.168.137.21 is an IP address
that 4 published sources report
in connection with APT38, Lazarus Group and unclustered DPRK activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Hunt.io, Validin, SlowMist and UN Security Council Panel of Experts (1718 Committee).
The earliest of those reports is dated 2023-12-06 and the most recent 2024-07-15.
ip address APT38Lazarus GroupDPRK (cluster unattributed) MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | HostPapa |
| Announced by | AS54290 HostPapa |
| Country | United States |
| Flags | hosting range |
Sources
-
…on these servers. Note: A complete list of domains will be provided at the end of this post. Figure 8: Snippet of domain history for 104.168.137.21 Figure 9: Domain history for 104.168.163.124 Another possible indicator I noticed when looking into this small infrastructure cluster is…
Phishing by Appointment: Suspected North Korean Hackers Target Blockchain Community Via Telegram — Hunt.io -
…Pivots from DNS History The subdomains for roomconnect.online (and not the apex domain) used two IP addresses before June 2024: 104.168.137.21 104.168.203.159 Subdomain DNS history shows two distinct periods of activity for this domain. More recently, after a gap…
Hunting Lazarus: Expanding Indicators with Historic DNS — Validin -
…attack methods on November 30, 2023: Press enter or click to view image in full size Basic Indicators of Compromise (IOC): IP: 104.168.137.21 Domains: Press enter or click to view image in full size Malicious Attack Examples Press enter or click to view image in full…
Analysis of North Korean Hackers’ Targeted Phishing Scams on Telegram — SlowMist -
…o Subsequent investigation determined that malicious IP address 104.168.137.21 had gained unauthorized access to the victim’s computer to effect the heist, and that the script had resulted in all of the victim’s…
access — UN Security Council Panel of Experts (1718 Committee)
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.