← All actor clusters

52.79.118.195

52.79.118.195 is an IP address that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Symantec. The earliest of those reports is dated 2026-09-12 and the most recent 2026-10-18.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2026-09-12 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …ff167e09b3b7ad6ed1dead9ee5b4747dd308699a00905e86162d1ec1b61e0476 Network 52.79.118.195 61.81.50.174 [URL]/[FOLDER]/[FILENAME]asp?prd_fld=racket happy.nanoace.co.kr…

  Lazarus Targets Chemical Sector — Symantec · under “Indicators of Compromise” · published 2022-04-14 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Lazarus Targets Chemical Sector

Symantec lists 16 other indicators in this source. 12 are shown, chosen across types.

• 164f6a8f7d2035ea47514ea84294348e32c90d817724b80ad9cd3af6f93d83f8 file hash
• 18686d04f22d3b593dd78078c9db0ac70f66c7138789ad38469ec13162b14cef file hash
• 1cb8ea3e959dee988272904dbb134dad93539f2c07f08e1d6e10e75a019b9976 file hash
• 2dd29b36664b28803819054a59934f7a358a762068b18c744281e1589af00f1f file hash
• 32bfdf1744077c9365a811d66a6ea152831a60a4f94e671a83228016fc87615f file hash
• 35de8163c433e8d9bf6a0097a506e3abbb8308330d3c5d1dea6db71e1d225fc3 file hash
• 4277fcaada4939b76a3df4515b7f74837bf8c4b75d4ff00f8d464169eede01e3 file hash
• 4446efafb4b757f7fc20485198236bed787c67ceffc05f70cd798612424384ce file hash
• 48f3ead8477f3ef16da6b74dadc89661a231c82b96f3574c6b7ceb9c03468291 file hash
• 4a2236596e92fa704d8550c56598855121430f96fe088712b043cba516f1c76c file hash
• 54029bd4fcc24551564942561a60b906bee136264f24f43775b7a8e15095a9e0 file hash
• 61.81.50.174 IP address

All 17 indicators from this source