← Remote Workers

45.61.131.218

45.61.131.218 is an IP address that 4 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from veryserious.systems, Group-IB, ESET and Threat Book. The earliest of those reports is dated 2024-09-04 and the most recent 2026-11-09.

ip address Contagious InterviewLazarus Group MATCHED IN SOURCE

First seen 2024-09-04 · last seen 2026-11-09

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …1224, 1244 Travis Mathison, FAMOUS CHOLLIMA 167.88.168.24 — Contagious Interview IOC lists 167.88.160.106 — FOFA tracking 45.61.131.218 — Travis Mathison 45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209 — Travis Mathison…

  Breaking down North Korea's continuation of BeaverTail — veryserious.systems · under “Breaking down North Korea's continuation of the BeaverTail campaign” · published 2026-06-13 · pulled 2026-09-09

• …consolidated network IoCs from published reports related to this long-running campaign. 23.106.253.194 45.61.129.255 45.61.130.0 45.61.131.218 45.61.160.14 45.61.169.187 45.140.147.208 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 144.172.74.48 144.172.…

  APT Lazarus: Eager Crypto Beavers, Video calls and Games | Group-IB Blog — Group-IB · under “Supercharge your cybersecurity with Group-IB Threat Intelligence” · published 2024-09-04 · pulled 2026-09-12

• …45.61.131.218 N/A RouterHosting LLC 2024‑01‑22 BeaverTail/InvisibleFerret C&C and staging server.…

  DeceptiveDevelopment targets freelance developers — ESET · under “Network” · published 2025-02-20 · pulled 2026-09-12

• …185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.17…

  Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation — Threat Book · under “Appendix - IOC” · published 2024-10-23 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Breaking down North Korea's continuation of BeaverTail

veryserious.systems lists 12 other indicators in this source. 5 are shown, chosen across types.

• 2956b023858d706a5e241cd28b845088e5f414c5f70bd5d8cb73cb427d081065 file hash
• 37e9dde0f35864e2ea8dcd4c8b5324ef50e3798195d04c30ba6938352af702db file hash
• 144.172.105.235 IP address
• 167.88.160.106 IP address
• 45.61.169.99 IP address

All 13 indicators from this source

Cited by the same report: APT Lazarus: Eager Crypto Beavers, Video calls and Games | Group-IB Blog

Group-IB lists 33 other indicators in this source. 4 are shown, chosen across types.

• 0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd file hash
• fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0 file hash
• 45.61.160.14 IP address
• 45.61.169.187 IP address

All 34 indicators from this source

Cited by the same report: DeceptiveDevelopment targets freelance developers

ESET lists 5 other indicators in this source. 3 are shown, chosen across types.

• 135.125.248.56 IP address
• 147.124.214.129 IP address
• 67.203.7.171 IP address

All 6 indicators from this source