← All actor clusters

104.168.167.16

104.168.167.16 is an IP address that 4 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kaspersky Securelist, CISA and Objective-see. The earliest of those reports is dated 2019-12-03 and the most recent 2021-04-15.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2019-12-03 · last seen 2021-04-15

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …Note that the 104.168.167.16 server is used as a C2 server.…

  Operation AppleJeus Sequel | Securelist — Kaspersky Securelist · under “Change of Windows malware” · published 2020-01-08 · pulled 2026-09-11

• …on an unnamed victim.[ 7 ] The unioncrypto.vip domain resolved to the following IP addresses from June 5, 2019, to July 15, 2020. 104.168.167.16 198.54.117.197 198.54.117.198 198.54.117.199 198.54.117.200 The domain unioncrypto.vip had a valid Sectigo SSL certificate…

  AppleJeus: Analysis of North Korea’s Cryptocurrency Malware | CISA — CISA · under “Introduction and Infrastructure” · published 2021-04-15 · pulled 2026-09-11

• …. The domain is registered with NameCheap at the IP address 104.168.167.16 with ASN 54290. Screenshots Figure 1 - Screenshot of the Union Crypto Trader…

  MAR-10322463-3.v1 - AppleJeus: Union Crypto | CISA — CISA · under “Description” · published 2021-02-17 · pulled 2026-09-12

• …attack, Lazarus group created a new website, unioncrypto.vip : \ Pinging this site reveals that it’s still online, and resolving to 104.168.167.16 : $ ping unioncrypto.vip PING unioncrypto.vip (104.168.167.16): 56 data bytes 64 bytes from 104.168.167.16: icmp_seq=0 ttl=112…

  Lazarus Group Goes 'Fileless' — Objective-see · under “Infection Vector” · published 2019-12-03 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Operation AppleJeus Sequel | Securelist

Kaspersky Securelist lists 15 other indicators in this source. 5 are shown, chosen across types.

• 3efeccfc6daf0bf99dcb36f247364052 file hash
• 48ded52752de9f9b73c6bf9ae81cb429 file hash
• 8b4c532f10603a8e199aa4281384764e file hash
• 104.168.218.42 IP address
• 108.174.195.134 IP address

All 16 indicators from this source

Cited by the same report: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware | CISA

CISA lists 27 other indicators in this source. 4 are shown, chosen across types.

• 104.200.67.96 IP address
• 107.187.66.103 IP address
• 145.249.106.19 IP address
• 146.112.61.107 IP address

All 28 indicators from this source

Cited by the same report: MAR-10322463-3.v1 - AppleJeus: Union Crypto | CISA

CISA lists 29 other indicators in this source. 3 are shown, chosen across types.

• noc@hostus.us email address
• 06d9f835efd1c05323f6a3abdf66e6be334e47c4 file hash
• 3eCYK5JEBXaM6Jq4p3MpJy5Tb3MpJy5T cryptocurrency wallet address

All 30 indicators from this source