`23.152.0.101`

23.152.0.101 is an IP address that 4 published sources report in connection with Lazarus Group, APT38 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from CISA, Symantec and JPCERT/CC. The earliest of those reports is dated 2021-02-17 and the most recent 2026-11-09.

ip address Lazarus Group APT38 Contagious Interview MATCHED IN SOURCE

First seen 2021-02-17 · last seen 2026-11-09

Network

Kind	data centre
Network	GWY IT PTY LTD (Crowncloud US LLC)
Announced by	AS199959 GWY IT PTY LTD
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…The domain is registered with NameCheap at the IP address 23.152.0.101 with ASN 8100. Relationship Summary 6b945159b4...…
MAR-10322463-4.v1 - AppleJeus: Kupay Wallet | CISA — CISA · under “Description” · published 2021-04-15 · pulled 2026-09-12
…(prtspool) [Redacted] (CoinGoTrade.dmg) Domains (4) airbseeker.com coingotrade.com globalkeystroke.com woodmate.it IPs (1) 23.152.0.101 Findings [Redacted] Tags dropper Details Name CoinGoTrade.msi Size [Redacted] bytes Type Composite Document…
MAR-10322463-5.v1 - AppleJeus: CoinGoTrade | CISA — CISA · under “IPs (1)” · published 2021-02-17 · pulled 2026-09-12
…Domain woodmate.it Domain dorusio.com Domain ants2whale.com Domain qnalytica.com Domain 216.189.150.185 IP 23.152.0.101 IP 45.147.231.77 IP About the Author Threat Hunter Team Symantec and Carbon Black The Threat Hunter Team is a group of…
Lazarus: Three North Koreans Charged for Financially Motivated Attacks — Symantec · under “Indicators of Compromise” · published 2021-02-18 · pulled 2026-09-12
…07.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.147 9.142.66.240 185.117.73.222 88.208.17.127 23.152.0.101 59.58.1.63 1.3.6.1 93.185.4.90 219.235.1.72 194.165.4.39 209.62.108.213 69.50.165.18 60.14.48.73 172.86.96.111 3.71.39.224 31.192.209.89 08…
Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: MAR-10322463-4.v1 - AppleJeus: Kupay Wallet | CISA

CISA lists 25 other indicators in this source. 5 are shown, chosen across types.

All 26 indicators from this source

Cited by the same report: MAR-10322463-5.v1 - AppleJeus: CoinGoTrade | CISA

CISA lists 23 other indicators in this source. 4 are shown, chosen across types.

All 24 indicators from this source

Cited by the same report: Lazarus: Three North Koreans Charged for Financially Motivated Attacks

Symantec lists 2 other indicators in this source.