← All actor clusters

104.168.165.203

104.168.165.203 is an IP address that 4 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB, Rewterz, Validin and SOCRadar. The earliest of those reports is dated 2024-07-15 and the most recent 2025-02-12.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2024-07-15 · last seen 2025-02-12

Network

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

• …T1105 Ingress Tool Transfer Indicators of Compromise (IOCs) Network IOCS support.cloudstore.business support.docsend.site 104.168.165.203 104.168.157.45 https://filedn.com/lY24cv0IfefboNEIN0I9gqR File hashes Filenames SHA256 Discussion Points…

  Stealthy Attributes of APT Lazarus Group | Group-IB Blog — Group-IB · under “Indicators of Compromise (IOCs)” · published 2024-11-13 · pulled 2026-09-12

• …Code Execution Sensitive Data Theft Indicators of Compromise Domain Name support.cloudstore.business support.docsend.site IP 104.168.165.203 104.168.157.45 MD5…

  Lazarus Group Uses New RustyAttr Malware for Extended Attribute Abuse to Target macOS – Active IOCs - Rewterz — Rewterz · under “IP” · published 2024-11-14 · pulled 2026-09-12

• …internal-meet.xyz Additionally, these IP addresses are net-new to our current search for Lazarus indicators: 104.168.203.161 104.168.165.203 104.168.165.173 104.168.165.165 Second-order Pivots through IP Addresses We can repeat the process from the beginning for each…

  Hunting Lazarus: Expanding Indicators with Historic DNS — Validin · under “Pivoting on Certificate Hash” · published 2024-07-15 · pulled 2026-09-12

• …of Compromise) for easy reference: Category IoCs Domains support.cloudstore.business support.docsend.site IP Addresses 104.168.165.203 104.168.157.45 URLs https://filedn.com/lY24cv0IfefboNEIN0I9gqR These IoCs can be utilized to enhance detection and prevention…

  Lazarus Group’s Latest Cyber Espionage Tactics Involving LinkedIn — SOCRadar · under “Indicators of Compromise (IoCs)” · published 2025-02-12 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Stealthy Attributes of APT Lazarus Group | Group-IB Blog

Group-IB lists 1 other indicator in this source.

• 104.168.157.45 IP address

Cited by the same report: Lazarus Group Uses New RustyAttr Malware for Extended Attribute Abuse to Target macOS – Active IOCs - Rewterz

Rewterz lists 31 other indicators in this source. 6 are shown, chosen across types.

• 0cbc6df98ce1d302f51714e100560a4d file hash
• 1602cc32d56ab7f7d70c508696134875a0a56000 file hash
• 176e8a5a7b6737f8d3464c18a77deef778ec2b9b42b7e7eafc888aeaf2758c2d file hash
• 22a477da55c7391dd0fc6176241d108e file hash
• 2efdf82808cd7f63ebc66f553ae94127c3d7c60b file hash
• 3439de0b221320f58e3432c2672c4074 file hash

All 32 indicators from this source

Cited by the same report: Hunting Lazarus: Expanding Indicators with Historic DNS

Validin lists 7 other indicators in this source. 5 are shown, chosen across types.

• 104.168.137.21 IP address
• 104.168.165.165 IP address
• 104.168.203.159 IP address
• 104.168.203.161 IP address
• 108.174.194.10 IP address

All 8 indicators from this source