212.91.193.27
212.91.193.27 is an IP address
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Narcass3 (@Narcass3) and tayvano (lazarus-bluenoroff-research).
The earliest of those reports is dated 2025-04-26 and the most recent 2026-10-18.
ip address IT Worker Fraud MATCHED IN SOURCE
Network
| Kind | fixed line |
|---|---|
| Network | PRIMORYE |
| Announced by | AS12389 PJSC Rostelecom |
| Country | Russia |
Sources
-
The post consists of the greeting "Hi 139.5.157.128 and 212.91.193.27 :)" over a photograph of three men opening bottles at what appears to be a party. It states no role for either address and names no operator, so the addresses anchor no persona here. The researcher tracks DPRK IT workers and the accompanying photograph matches the group images published elsewhere on the account, which is the context in which the addresses were posted. The same two addresses appear independently in tayvano's public DPRK IT-worker research repository, under a "Face Pix" heading that follows a section break rather than inside any operator's entry, so that source does not attribute them either. The scraper does not create records from them because IPv4 extraction is not enabled for scraped sources.
x.com/Narcass3/status/1916191078631289200 — Narcass3 (@Narcass3) -
…https://github.com/sallamy2580 -  -  --- ## Face Pix #### 139.5.157.128 and 212.91.193.27 - https://x.com/Narcass3/status/1916191078631289200 -  #### AI Face -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.