← Remote Workers

45.126.3.252

45.126.3.252 is an IP address that 3 published sources report in connection with IT Worker Fraud, Moonstone Sleet and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from tayvano (lazarus-bluenoroff-research) and Chollima Group. The earliest of those reports is dated 2025-08-25 and the most recent 2026-10-18.

ip address IT Worker FraudMoonstone SleetDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2025-08-25 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• Nearby text:

  …0xC5ABDE4CE8C5740F4bad6C3B05E4Da31d229659 #### Misc - 45.126.3.252 - 188.43.136.0/24 - topdeveloper01234@gmail.com - bigben199551@gmail.com - realhardworkingdeveloper@gmail.com -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Misc” · published 2025-06-19 · pulled 2026-09-01

• Nearby text:

  …Ybarra Leo Pawel Powel Lee Wallet: 0xC5ABDE4CE8C5740F4bad6C3B05E4Da31d229659 Others: --------------------------------------------- IPs: 45.126.3.252 188.43.136.0/24 Emails: topdeveloper01234@gmail.com bigben199551@gmail.com realhardworkingdeveloper@gmail.com thomasanderson19960313@gmail…

  Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group — Chollima Group · under “IOCs.” · published 2025-08-25 · pulled 2026-10-18

• …By analyzing leak data for intellichain555@gmail.com[email protected] , we can see that it has previously originated from the DPRK IP 45.126.3.252 , an IP associated with NetKey/OConnect.…

  Bells Ringing in Dar es Salaam — Chollima Group · under “Gold Seas and Jilin.” · published 2025-09-04 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 5 are shown, chosen across types.

• https://calendly.com/codeninja819 Calendly account
• https://dev.to/david_wenske_0b5dfdc82e27 DEV Community account
• ucas0holm@gmail.com email address
• https://fiverr.com/derekmiller03 Fiverr account
• 83.234.227.52 IP address

All 855 indicators from this source

Cited by the same report: Dubai, Crypto, Moonstone Sleet, and the Pivot Odyssey | Chollima Group

Chollima Group lists 109 other indicators in this source. 4 are shown, chosen across types.

• hexiao33@mail.ru email address
• https://github.com/jayceetran GitHub account
• https://laborx.com/freelancers/users/id328992 LaborX account
• https://www.linkedin.com/in/jaycee-tran-a2873230b/ LinkedIn account

All 110 indicators from this source

Cited by the same report: Bells Ringing in Dar es Salaam

Chollima Group lists 44 other indicators in this source. 3 are shown, chosen across types.

• ddksniper@gmail.com email address
• https://github.com/intellichain555 GitHub account
• https://www.linkedin.com/in/hailong-jin-906375118/ LinkedIn account

All 45 indicators from this source