`54.226.210.44`

54.226.210.44 is an IP address that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from 安恒信息. The report is dated 2022-06-02.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2022-06-02 · last seen 2022-06-02

Network

Kind	data centre
Network	Amazon.com, Inc. (AWS EC2 (us-east-1))
Announced by	AS14618 Amazon.com, Inc.
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

…且该组织在这次的攻击中使用CobaltStrike作为最终投递的攻击载荷，这点与该组织在过去的活动中最后阶段投递的远控也有所差异。同样捕获了一批疑似该组织的测试样本，上传时间在今年的5月14日左右，这些样本使用与捕获的样本一样的TTP，这些样本使用54.80.204.133、54.226.210.44作为payload的下载服务器以及最终CobaltStriketeamserver的地址。…
近期Lazarus持续针对加密货币行业展开攻击活动 - 安恒威胁情报中心 — 安恒信息 · under “拓展：” · published 2022-06-02 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: 近期Lazarus持续针对加密货币行业展开攻击活动 - 安恒威胁情报中心

安恒信息 lists 3 other indicators in this source.