← Remote Workers

83.234.227.52

83.234.227.52 is an IP address that 2 published sources report in connection with IT Worker Fraud and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from tayvano (lazarus-bluenoroff-research) and Security Scorecard. The earliest of those reports is dated 2025-01-29 and the most recent 2026-10-18.

ip address IT Worker FraudLazarus Group MATCHED IN SOURCE

First seen 2025-01-29 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• …t.me/bcstar18 (ID: 5915387318) • [Messages](./user-5915387318-@bcstar18.txt) - 188.43.235.177 Mar 2022 - 188.43.33.249 Sept 2024 - 83.234.227.52 Dec 2024 - 0x73Fd6C969514Cb6bE9BB9620Eaf79Cbda5887fb4 - 0xabbcbd048bc3f54f7bca806bc23beafded7e944c -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Alexandru-Gabriel Dumitras” · published 2025-06-19 · pulled 2026-09-01

• …185.153.182.241 86.104.74.51 5.253.43.122 45.128.52.14 Proxy Servers 83.234.227.49 83.234.227.50 83.234.227.51 83.234.227.52 83.234.227.53 VPN Exit Points 70.39.70.196 70.39.70.197 Spoofed Domains sageskills-uk.com Ports 1224:…

  Operation Phantom Circuit: North Korea's Global Data Exfiltration Campaign — Security Scorecard · under “Proxy Servers” · published 2025-01-29 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 7 are shown, chosen across types.

• https://calendly.com/zerobit417 Calendly account
• https://dev.to/scott_brown_b611d05a865cf DEV Community account
• venus07250000@gmail.com email address
• https://fiverr.com/derekmiller03 Fiverr account
• https://freelancer.com/u/spectrecoder Freelancer.com account
• https://freelancermap.com/profile/denis-rudink freelancermap account
• https://laborx.com/freelancers/users/id126269 LaborX account

All 855 indicators from this source

Cited by the same report: Operation Phantom Circuit: North Korea's Global Data Exfiltration Campaign

Security Scorecard lists 20 other indicators in this source. 5 are shown, chosen across types.

• 175.45.176.27 IP address
• 175.45.176.68 IP address
• 83.234.227.53 IP address
• 86.104.74.51 IP address
• 94.131.9.32 IP address

All 21 indicators from this source