`104.145.210.107`

104.145.210.107 is an IP address that 4 published sources report in connection with APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from LevelBlue, Arctic Wolf, Darktrace and Microsoft. The earliest of those reports is dated 2026-04-16 and the most recent 2026-06-24.

ip address APT38 MATCHED IN SOURCE

First seen 2026-04-16 · last seen 2026-06-24

Network

Kind	data centre
Network	Ultahost, Inc.
Announced by	AS398256 Ultahost, Inc.
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…Staged archives are uploaded via nohup curl to remote port 8443, though official exfiltration traffic has been reported on 104.145.210.107:6783. Figure 1.…
Sapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign — LevelBlue · under “Attack Chain Breakdown (Kill Chain)” · published 2026-05-28 · pulled 2026-09-11
…accounts. The staged data is compressed to %TEMP%\tel_<username>.zip and exfiltrated via a POST request using curl.exe to https://104.145.210.107:8444/upload with a unique victim mid GUID and a server authentication header. Discovery: Installed Software Enumeration The next module…
BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector — Arctic Wolf · under “Data Theft: Telegram Desktop Sessions” · published 2026-04-27 · pulled 2026-09-12
…check02id.com associated with IP address, 83.136.210.180 [4] over port 7365 Outbound connections to the rare external endpoints, 104.145.210.107 [5] over port 8443 and 83.136.208.48 [6] over port 443 Outbound connections to the rare external endpoint, 83.136.208.246 [7] over port…
From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions — Darktrace · under “Darktrace coverage and detections” · published 2026-06-24 · pulled 2026-09-12
…"check02id.com"]); let c2_ips = dynamic(["188.227.196.252", "83.136.208.246", "83.136.209.22", "83.136.208.48", "83.136.210.180", "104.145.210.107", “188.227.197.136”]); DeviceNetworkEvents | where Timestamp > ago(30d) | where RemoteUrl has_any (c2_domains) or RemoteIP in (c2_ips)…
Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise — Microsoft · under “Microsoft Defender XDR” · published 2026-04-16 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Sapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign

LevelBlue lists 5 other indicators in this source.

Cited by the same report: BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector

Arctic Wolf lists 7 other indicators in this source. 4 are shown, chosen across types.

All 8 indicators from this source

Cited by the same report: From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

Darktrace lists 4 other indicators in this source. 1 are shown, chosen across types.

All 5 indicators from this source