`104.200.137.32`

104.200.137.32 is an IP address that 2 published sources report in connection with APT38 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from JPCERT/CC. The earliest of those reports is dated 2023-04-30 and the most recent 2023-05-11.

ip address APT38DPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2023-04-30 · last seen 2023-05-11

Network

Kind	data centre
Network	Performive LLC (Hosting Services, Inc)
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…ion-service.cloud verify.azure-protect.online docs.azure-protection.cloud secure.azure-protection.cloud web.j-ic.co cloud.dnx.capital 104.200.137.32 one.microshare.cloud www.capmarketreport.com safe.doc-share.cloud openaibt.com cloud.espcapital.pro autoprotect.com.de Appendix…
攻撃キャンペーンDangerousPasswordに関連する攻撃動向 - JPCERT/CC Eyes | JPCERTコーディネーションセンター公式ブログ — JPCERT/CC · under “Appendix A: 通信先” · published 2023-04-30 · pulled 2026-09-12
…ion-service.cloud verify.azure-protect.online docs.azure-protection.cloud secure.azure-protection.cloud web.j-ic.co cloud.dnx.capital 104.200.137.32 one.microshare.cloud www.capmarketreport.com safe.doc-share.cloud openaibt.com cloud.espcapital.pro autoprotect.com.de Appendix…
Attack Trends Related to DangerousPassword — JPCERT/CC · under “Appendix A: C2” · published 2023-05-11 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Attack Trends Related to DangerousPassword

JPCERT/CC lists 2 other indicators in this source.