← All actor clusters

50.192.28.29

50.192.28.29 is an IP address that 3 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from ESET and ClearSky Cyber Security. The earliest of those reports is dated 2020-08-23 and the most recent 2026-11-09.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2020-08-23 · last seen 2026-11-09

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• …2021‑10‑12 A compromised legitimate WordPress-based site hosting the C&C server https://turnscor.com/wp-includes/feedback.php 50.192.28.29 Comcast Cable Communications, LLC 2021‑10‑12 A compromised legitimate site hosting the C&C server…

  Amazon-themed campaigns of Lazarus in the Netherlands and Belgium — ESET · under “Network” · published 2022-09-30 · pulled 2026-09-12

• …SAS 2021‑10‑10 A compromised legitimate site hosting the C&C server: http://bug.restoroad.com/admin/view_status.php 50.192.28.29 hurricanepub.com Comcast Cable Communications, LLC 2020‑01‑06 A compromised legitimate site hosting the C&C…

  Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company — ESET · under “Network” · published 2023-09-29 · pulled 2026-09-12

• …successfully accessed by the attack group to be used as malware download websites: Compromised domain Serve r colasprint.com 50.192.28.29 speed-stream.com kyungrok.com 118.217.183.180 roit.co.kr 110.45.138.98 warevalley.com 112.175.226.221 ktri.or.kr…

  Operation ‘Dream Job’ Widespread North Korean Espionage Campaign — ClearSky Cyber Security · published 2020-08-23 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Amazon-themed campaigns of Lazarus in the Netherlands and Belgium

ESET lists 4 other indicators in this source.

• 296d882cb926070f6e43c99b9e1683497b6f17c4 file hash
• 5f4fbd57319bd0d2df31131e864fdda9590a652d file hash
• 31.11.32.79 IP address
• 67.225.140.4 IP address

Cited by the same report: Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company

ESET lists 11 other indicators in this source. 4 are shown, chosen across types.

• c273b244ea7dff20b1d6b1c7fd97f343201984b3 file hash
• 118.98.221.14 IP address
• 78.11.12.13 IP address
• 89.187.86.214 IP address

All 12 indicators from this source

Cited by the same report: Operation ‘Dream Job’ Widespread North Korean Espionage Campaign

ClearSky Cyber Security lists 19 other indicators in this source. 4 are shown, chosen across types.

• 51.68.119.230 IP address
• 51.79.44.111 IP address
• 54.241.91.49 IP address
• 54.39.64.114 IP address

All 20 indicators from this source