`5.255.101.148`

5.255.101.148 is an IP address that 2 published sources report in connection with Contagious Interview, APT38 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Unit 42 and Objective-See. The earliest of those reports is dated 2025-01-01 and the most recent 2025-02-26.

ip address Contagious Interview APT38DPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2025-01-01 · last seen 2025-02-26

Network

Kind	proxy or VPN
Network	The Infrastructure Group B.V. (TIG)
Announced by	AS60404 Liteserver
Country	The Netherlands
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

…https://apple-ads-metric.com RustDoor C2 domain https://visualstudiomacupdate.com macOS Koi Stealer C2 IP address 5.255.101.148 Reverse shell IP address 31.41.244.92 Strings encryption key xRdEh3f6g1qxTxsCfg1d30W66JuUgQvVti Appendix C:…
RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector — Unit 42 · under “Koi Stealer macOS Variant” · published 2025-02-26 · pulled 2026-09-12
…stealer then surveys the system and collects several pertinent details, which are sent to the attacker’s command-and-control server at 5.255.101.148 .…
The Mac Malware of 2025 — Objective-See · under “👾 Koi Stealer” · published 2025-01-01 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector

Unit 42 lists 2 other indicators in this source.

Cited by the same report: The Mac Malware of 2025

Objective-See lists 2 other indicators in this source.