142.11.206.73
142.11.206.73 is an IP address
that 9 published sources report
in connection with IT Worker Fraud, Contagious Interview and APT38 activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Kudelski Security Research, Decryption Digest, Elastic Security Labs, N3mes1s, Hunt.io, Threat Book, Microsoft, DCSO and IGLOO Security.
The earliest of those reports is dated 2026-03-31 and the most recent 2026-10-18.
ip address IT Worker FraudContagious InterviewAPT38 MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | HostPapa |
| Announced by | AS54290 HostPapa |
| Country | United States |
| Flags | hosting range |
Sources
-
…(shasum: 07d889e2dadce6f3910dcbc253317d28ca61c766) Network Indicators : C2 domain: sfrclak.com C2 IP: 142.11.206.73 C2 POST body (macOS) · packages.npm.org/product0 C2 POST body (Windows) · packages.npm.org/product1 C2 POST body (Linux) ·…
Kudelski Security Research — Kudelski Security Research -
…Windows, Registry run key WAVESHAPER.V2 persistence /tmp/ld.py Linux, Python RAT Executed via nohup for persistence sfrclak.com / 142.11.206.73 All platforms, C2 Block at firewall and DNS layer immediately axios@1.14.1 or axios@0.30.4 in lock file npm, Backdoored Axios versions…
North Korea Supply Chain 2026: 1,700 Malicious Packages — Decryption Digest -
…MacOS payload fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf SHA-256 ld.py Linux payload sfrclak.com DOMAIN C2 142.11.206.73 ipv4-addr C2 References The following were referenced throughout the above research:…
Inside the Axios supply chain compromise - one RAT to rule them all — Elastic Security Labs -
…— Persistent BlueNoroff Infrastructure 9 confirmed BlueNoroff/Lazarus IPs on Hostwinds: IP Campaign Year Source 142.11.206.73 Axios C2 (sfrclak.com) 2026 This analysis 142.11.209.109 Lazarus infrastructure 2025 Hunt.io cert hwc-hwp-7779700…
Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution — N3mes1s -
…deployed: compiled C++ Mach-O for macOS, fileless PowerShell for Windows, Python stdlib-only for Linux Single C2 at sfrclak.com:8000 (142.11.206.73) routes payloads by POST body: product0 for macOS, product1 for Windows, product2 for Linux Four shared C2 commands across all platforms:…
Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444 — Hunt.io -
…behind it is the Lazarus APT Group. Appendix Previously Disclosed IOCs C2 sfrclak.com http://sfrclak.com:8000/6202033 142.11.206.73 Hash Platform SHA256 Linux ( ld.py ) fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf Windows…
Lazarus Group Poisons Axios: Inside the npm Supply Chain Attack — Threat Book -
…The associated IP address (142.11.206.73) is tied to Hostwinds, a virtual private server (VPS) provider that Sapphire Sleet is known to commonly use when establishing C2. All…
Mitigating the Axios npm supply chain compromise — Microsoft -
…if there are still services running on open ports. According to passive DNS data, the mentioned C2 domain sfrclak.com resolves to the IP 142.11.206.73.…
From Axios NPM Supply Chain Attack to Tracking DPRK’s BlueNoroff — DCSO -
…에서 추출), 그리고 PID, 부모 PID, 사용자 이름, 명령줄이 포함된 전체 프로세스 목록(모두 /proc/ 에서 직접 읽어옴)을 전송(다른 운영체제와 동일) [Stage 4] Python RAT • 142.11.206.73:8000 (Express.js 구동)에 위치한 C2 서버는 POST 요청에 응답하여 페이로드를 제공(GET 요청시 500에러를 반환) • safedep 에 따르면 packages.npm.org/product2 를 사용해서 Linux의 2단계…
Supply Chain Attack on Axios NPM Package via North Korean Threat Actors — IGLOO Security
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.
Related indicators
Cited by the same report: Kudelski Security Research
All 67 indicators from this source