`94.131.9.32`

94.131.9.32 is an IP address that 3 published sources report in connection with Lazarus Group and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Security Scorecard, IGLOO Security and JPCERT/CC. The earliest of those reports is dated 2025-01-29 and the most recent 2026-11-09.

ip address Lazarus Group Contagious Interview MATCHED IN SOURCE

First seen 2025-01-29 · last seen 2026-11-09

Network

Kind	proxy or VPN
Network	WorkTitans B.V. (WorkTitans B.V)
Announced by	AS209847 WorkTitans B.V.
Country	France
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

…Their role was serving payloads and collecting data from victims Server IP Active Period Role 94.131.9.32 January 2025 Latest command-and-control (C2) server.…
Operation Phantom Circuit: North Korea's Global Data Exfiltration Campaign — Security Scorecard · under “Infrastructure and Operation” · published 2025-01-29 · pulled 2026-09-12
…9 twitterapis taras_lakhai 45.61.151.71 :1224/client/9/906 10 dev-debugger-vite wishorn 94.131.9.32 :1224/client/7/703 11 snore-log wishorn https://ip-api-server.vercel.app/api/ipcheck/701 12…
북한 위협 행위자 Contagious Interview 캠페인 분석(2보) — IGLOO Security · under “3.3 BeaverTail 악성코드 분석” · published 2025-05-13 · pulled 2026-09-12
…67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.198.66.158 91.92.120.135 93.127.134.237 94.131.97.195 94.131.9.32 94.232.247.192 95.164.17.24 95.164.33.66 95.164.45.239 95.217.124.253 angeloperonline.online lianxinxiao.com sageskills-uk.com www.dalas.nl…
Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Operation Phantom Circuit: North Korea's Global Data Exfiltration Campaign

Security Scorecard lists 20 other indicators in this source. 5 are shown, chosen across types.

All 21 indicators from this source

Cited by the same report: 북한 위협 행위자 Contagious Interview 캠페인 분석(2보)

IGLOO Security lists 19 other indicators in this source. 4 are shown, chosen across types.

All 20 indicators from this source

Cited by the same report: Contagious Interview IoCs

JPCERT/CC lists 539 other indicators in this source. 3 are shown, chosen across types.

All 540 indicators from this source