`104.200.67.96`

104.200.67.96 is an IP address that 2 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from CISA. The reports are dated 2021-04-15.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2021-04-15 · last seen 2021-04-15

Network

Kind	data centre
Network	Web2Objects LLC (Crowncloud US LLC)
Announced by	AS199959 GWY IT PTY LTD
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…on their website kupaywallet.com ( Acquire Infrastructure: Domain [ T1583.001 ]). The domain www.kupaywallet.com resolved to IP address 104.200.67.96 from March 20, 2020, to January 16, 2021.…
AppleJeus: Analysis of North Korea’s Cryptocurrency Malware | CISA — CISA · under “Introduction and Infrastructure” · published 2021-04-15 · pulled 2026-09-11
…as the administrative or technical contact for the kupaywallet.com domain. The domain is registered with NameCheap at the IP address 104.200.67.96 with ASN 8100. In addition to the site kupaywallet.com, a Twitter account @kupayservice is associated with the company.…
MAR-10322463-4.v1 - AppleJeus: Kupay Wallet | CISA — CISA · under “Description” · published 2021-04-15 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware | CISA

CISA lists 27 other indicators in this source. 7 are shown, chosen across types.

All 28 indicators from this source

Cited by the same report: MAR-10322463-4.v1 - AppleJeus: Kupay Wallet | CISA

CISA lists 25 other indicators in this source. 5 are shown, chosen across types.

All 26 indicators from this source