← All actor clusters

185.142.239.173

185.142.239.173 is an IP address that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kaspersky Securelist. The report is dated 2018-08-23.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2018-08-23 · last seen 2018-08-23

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …AS174 COGENT-174 Additional attacker’s server from telemetry 80.82.64.91: Seychelles Incrediserve Ltd AS29073 185.142.239.173: Netherlands Blackhost Ltd.…

  Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware | Securelist — Kaspersky Securelist · under “Infrastructure” · published 2018-08-23 · pulled 2026-09-11

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware | Securelist

Kaspersky Securelist lists 20 other indicators in this source. 12 are shown, chosen across types.

• AS174 autonomous system number
• AS29073 autonomous system number
• AS3741 autonomous system number
• johnbroox200@gmail.com email address
• 94dfcabd8ba5ca94828cd5a88d6ed488 file hash
• bbbcf6da5a4c352e8846bf91c3358d5c file hash
• d7089e6bc8bd137a7241a7ad297f975d file hash
• d8484469587756ce0d10a09027044808 file hash
• 185.142.236.213 IP address
• 185.142.236.226 IP address
• 196.38.48.121 IP address
• 80.82.64.91 IP address

All 21 indicators from this source