`172.86.98.240`

172.86.98.240 is an IP address that 5 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from veryserious.systems, Group-IB, NVISO, Threat Book and JPCERT/CC. The earliest of those reports is dated 2024-09-04 and the most recent 2026-11-09.

ip address Contagious Interview Lazarus Group MATCHED IN SOURCE

First seen 2024-09-04 · last seen 2026-11-09

Network

Kind	data centre
Network	RouterHosting LLC (FranTech Solutions)
Announced by	AS14956 RouterHosting LLC
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209 — Travis Mathison 144.172.105.235 — Socket.dev 172.86.98.240 1224, 1244 Travis Mathison 172.86.80.145 1224 Travis Mathison Shodan.io also reveals a Windows remote desktop on port 3389 with…
Breaking down North Korea's continuation of BeaverTail — veryserious.systems · under “Breaking down North Korea's continuation of the BeaverTail campaign” · published 2026-06-13 · pulled 2026-09-09
…7.124.212.146 147.124.214.129 147.124.214.131 147.124.214.237 167.88.36.13 167.88.168.152 167.88.168.24 172.86.97.80 172.86.98.143 172.86.98.240 172.86.123.35 173.211.106.101 185.235.241.208 blocktestingto.com de.ztec.store:8000 http://freeconference.io http://mirotalk.net ht…
APT Lazarus: Eager Crypto Beavers, Video calls and Games | Group-IB Blog — Group-IB · under “Supercharge your cybersecurity with Group-IB Threat Intelligence” · published 2024-09-04 · pulled 2026-09-12
…147.124.197.149 147.124.212.146 147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154…
Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery — NVISO · under “Indicators of Compromise (IOCs)” · published 2025-11-13 · pulled 2026-09-12
…147.124.214.131 147.124.214.237 166.88.132.39 167.88.164.29 167.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129…
Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation — Threat Book · under “Appendix - IOC” · published 2024-10-23 · pulled 2026-09-12
…7.88.168.152 172.86.100.168 172.86.106.119 172.86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 2…
Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Breaking down North Korea's continuation of BeaverTail

veryserious.systems lists 12 other indicators in this source. 5 are shown, chosen across types.

All 13 indicators from this source

Cited by the same report: APT Lazarus: Eager Crypto Beavers, Video calls and Games | Group-IB Blog

Group-IB lists 33 other indicators in this source. 4 are shown, chosen across types.

All 34 indicators from this source

Cited by the same report: Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

NVISO lists 67 other indicators in this source. 3 are shown, chosen across types.

All 68 indicators from this source