`144.172.96.35`

144.172.96.35 is an IP address that 6 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cisco Talos, Bitmex, Ransom-ISAC, GBHackers on Security, blog.talosintelligence.com and Cisco Talos (GitHub IOC repository). The earliest of those reports is dated 2025-05-30 and the most recent 2026-10-18.

ip address Contagious Interview Lazarus Group MATCHED IN SOURCE

First seen 2025-05-30 · last seen 2026-10-18

Network

Kind	data centre
Network	RouterHosting LLC (FranTech Solutions)
Announced by	AS14956 RouterHosting LLC
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…http[://]138.201.50.5:5961/upload http[://]135.181.123.177/api/service/makelog http[://]144.172.96.35/api/service/makelog http[://]144.172.112.50/api/service/makelog http[://]172.86.73.46 http[://]135.181.123.177…
BeaverTail and OtterCookie evolve with a new Javascript module — Cisco Talos · under “IOCs” · published 2025-10-16 · pulled 2026-09-12
…at bitmex dot com. Indicators of Compromise (IoCs) Supabase URL https://mkswbddldpyiqkyu.supabase.co/ C2 URL http://144.172.96.35/ Threat Actor: Victor@3-KZH 107.182.231.193, 107.182.231.196, 120.226.22.28, 184.174.5.149, 223.104.144.97, 31.13.189.10,…
Beyond the Pond Phish: Unraveling Lazarus Group’s Evolving Tactics — Bitmex · under “Indicators of Compromise (IoCs)” · published 2025-05-30 · pulled 2026-09-12
…to mention 138.201.50.5 Hetzner Online GmbH Same ASN as Cluster-3 135.181.123.177 Hetzner Online GmbH Same ASN as Cluster-3 144.172.96.35 ROUTERHOSTING Historically hosted on PONYNET 144.172.112.50 ROUTERHOSTING socket.io URL with mismatched pingTimeout parameter…
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC · under “Source1: Cisco Talos - Beavertail and Ottercookie” · published 2025-11-13 · pulled 2026-09-12
…name: CoinLocator-main coin-promoting-app-main 0xhpenvynb-mvp_gamba-6b10f2e9dd85 IP: 144.172.96.35 107.189.24.80 135.181.123.177 Favicon Hash: 41ee7ddb2be173686dc3a73a49b4e93bc883ef363acca770f7ede891451122ab Find this Story…
Lazarus Group Enhances Malware with New OtterCookie Payload Delivery Technique — GBHackers on Security · under “IP:” · published 2025-07-30 · pulled 2026-09-12
…http[://]138.201.50.5:5961/upload http[://]135.181.123.177/api/service/makelog http[://]144.172.96.35/api/service/makelog http[://]144.172.112.50/api/service/makelog http[://]172.86.73.46 http[://]135.181.123.177…
BeaverTail and OtterCookie evolve with a new Javascript module · under “IOCs” · published 2025-10-16 · pulled 2026-09-18
Nearby text:

….188/api/service/process/c841b6c4ac4d2e83f16cf7a8bfbec3d7 http://138.201.50.5:5961/upload http://135.181.123.177/api/service/makelog http://144.172.96.35/api/service/makelog http://144.172.112.50/api/service/makelog http://172.86.73.46 http://135.181.123.177 http://172.86.113.12 https://www.n…
BeaverTail and OtterCookie — Cisco Talos (GitHub IOC repository) · published 2025-10-16 · pulled 2026-09-29

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: BeaverTail and OtterCookie evolve with a new Javascript module

Cisco Talos lists 5 other indicators in this source.

Cited by the same report: Beyond the Pond Phish: Unraveling Lazarus Group’s Evolving Tactics

Bitmex lists 30 other indicators in this source. 4 are shown, chosen across types.

All 31 indicators from this source

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1)

Ransom-ISAC lists 131 other indicators in this source. 3 are shown, chosen across types.

All 132 indicators from this source