64.44.141.15
64.44.141.15 is an IP address
that 4 published sources report
in connection with APT38 and Lazarus Group activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Elastic Security Labs and Elastic Security Labs (GitHub indicator release).
The earliest of those reports is dated 2023-07-14 and the most recent 2026-10-18.
ip address APT38Lazarus Group MATCHED IN SOURCE
Network
| Kind | fixed line |
|---|---|
| Network | DataWagon, LLC |
| Announced by | AS27176 DataWagon LLC |
| Country | United States |
Sources
-
…we were able to cluster these atomic entities, and their siblings, together with high confidence: All hosts were registered to 64.44.141.15 starbucls.xyz and crypto.hondchain.com were observed being used by our malware samples starbucls.xyz and jaicvc.com shared a TLS…
The DPRK strikes using a new variant of RUSTBUCKET — Elastic Security Labs -
…DangerousPassword and BlueNorOff are campaigns that have both been previously associated with the DPRK. Using the IP address ( 64.44.141.15 ) for our initial C2 domain, crypto.hondchain.com , we uncovered 3 additional C2 domains: starbucls.xyz jaicvc.com…
The DPRK strikes using a new variant of RUSTBUCKET — Elastic Security Labs -
…"type": "ipv4-addr"}}} {"threat": {"indicator": {"description": "Simple indicator of observable {64.44.141.15}", "ip": ["64.44.141.15"], "marking": {"tlp": "clear"}, "provider": "Elastic Security Labs", "reference":…
RUSTBUCKET indicators — Elastic Security Labs (GitHub indicator release) -
…DangerousPassword and BlueNorOff are campaigns that have both been previously associated with the DPRK. Using the IP address ( 64.44.141.15 ) for our initial C2 domain, crypto.hondchain.com , we uncovered 3 additional C2 domains: starbucls.xyz jaicvc.com…
The DPRK strikes using a new variant of RUSTBUCKET — Elastic Security Labs -
…DangerousPassword and BlueNorOff are campaigns that have both been previously associated with the DPRK. Using the IP address ( 64.44.141.15 ) for our initial C2 domain, crypto.hondchain.com , we uncovered 3 additional C2 domains: starbucls.xyz jaicvc.com…
The DPRK strikes using a new variant of RUSTBUCKET — Elastic Security Labs
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.