`138.201.128.169`

138.201.128.169 is an IP address that 2 published sources report in connection with Contagious Interview and IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kudelski Security and Kudelski Security Research. The earliest of those reports is dated 2026-09-01 and the most recent 2026-10-18.

ip address Contagious Interview IT Worker Fraud MATCHED IN SOURCE

First seen 2026-09-01 · last seen 2026-10-18

Network

Kind	data centre
Network	Hetzner Online GmbH (Hetzner)
Announced by	AS24940 Hetzner Online GmbH
Country	Germany
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…Figure 10: C2 communication Once the base64 is decoded we can now know the C2 and the endpoint behind these communications http://138.201.128.169:1224/api/checkStatus. We can now know that the structure follow this patterns <IP>:1224/api/<Value> We see that the server is hosted at…
How DPRK’s Contagious Interview Campaign Targets Developers - Kudelski Security Research Center — Kudelski Security · under “Backdoor with “routes/api/auth.js”” · published 2026-06-30 · pulled 2026-09-01
…Figure 10: C2 communication Once the base64 is decoded we can now know the C2 and the endpoint behind these communications http://138.201.128.169:1224/api/checkStatus. We can now know that the structure follow this patterns <IP>:1224/api/<Value> We see that the server is hosted at…
Kudelski Security Research — Kudelski Security Research · under “Backdoor with “routes/api/auth.js”” · published 2025-03-05 · pulled 2026-09-10

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Kudelski Security Research

Kudelski Security Research lists 66 other indicators in this source. 12 are shown, chosen across types.

All 67 indicators from this source