← Remote Workers

185.135.76.89

185.135.76.89 is an IP address that 3 published sources report in connection with IT Worker Fraud and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Sekoia.io Threat Detection & Research / Kudelski Security, Kudelski Security Research and Recorded Future. The earliest of those reports is dated 2026-09-07 and the most recent 2026-10-18.

ip address IT Worker FraudContagious Interview MATCHED IN SOURCE

First seen 2026-09-07 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

• …23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious Interview (Recorded Future) Recorded Future 45.86.208.162…

  Beyond Lazarus: How North Korea Organizes Its Cyber Operations — Sekoia.io Threat Detection & Research / Kudelski Security · under “Annex 2 - Overlap between fake IT workers and DPRK offensive campaigns” · published 2026-09-07 · pulled 2026-09-09

• …23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181 Contagious Interview (Recorded future) https:// www.recordedfuture.com/…

  Kudelski Security Research — Kudelski Security Research · under “Annexes” · published 2025-03-05 · pulled 2026-09-10

• ….61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.205.130 185.135.76.89 185.135.76.115 185.152.67.39 185.183.104.67 185.245.80.217 192.74.247.161 192.119.10.67 192.161.60.132 193.19.205.26 194.33.45.162 195.146.…

  PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix C: Astrill VPN Nodes” · published 2026-01-21 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Beyond Lazarus: How North Korea Organizes Its Cyber Operations

Sekoia.io Threat Detection & Research / Kudelski Security lists 12 other indicators in this source. 5 are shown, chosen across types.

• 188.43.33.252 IP address
• 211.21.6.181 IP address
• 23.237.102.130 IP address
• 37.120.154.98 IP address
• 38.75.137.97 IP address

All 13 indicators from this source

Cited by the same report: Kudelski Security Research

Kudelski Security Research lists 66 other indicators in this source. 4 are shown, chosen across types.

• AS8359 autonomous system number
• env-check.daemontools.cc domain
• nrwise@proton.me email address
• 91d48ee33a92acef02d8c8153d1de7e7fe8ffa0f3b6e5cebfcb80b3eeebc94f1 file hash

All 67 indicators from this source

Cited by the same report: PurpleBravo’s Targeting of the IT Software Supply Chain

Recorded Future lists 216 other indicators in this source. 3 are shown, chosen across types.

• ricogonzalez1013@gmail.com email address
• techsavvy001013@outlook.com email address
• 185.183.104.67 IP address

All 217 indicators from this source