`210.52.109.22`

210.52.109.22 is an IP address that 2 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB and Lexfo. The earliest of those reports is dated 2017-05-30 and the most recent 2020-10-08.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2017-05-30 · last seen 2020-10-08

Network

Kind	fixed line
Network	CNC Group CHINA169 Guangdong Province Network
Announced by	AS9929 CHINA UNICOM Industrial Internet Backbone
Country	China

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

…to analysis of Lazarus infrastructure, Group-IB specialists have detected that the attack was controlled from two IP addresses: 210.52.109.22 belongs to an autonomous system China Netcom.…
LAZARUS ARISEN | Group-IB Blog — Group-IB · under “Attack Organizers: Involvement of North Korea” · published 2017-05-30 · pulled 2026-09-12
…During an investigation, Group-IB discovered that Lazarus operators connected to a C&C using two IP addresses from North Korea ( 210.52.109.22 and 175.45.178.222 ).…
The Lazarus Constellation - A study on North-Korean malware — Lexfo · published 2020-10-08 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: LAZARUS ARISEN | Group-IB Blog

Group-IB lists 3 other indicators in this source.

Cited by the same report: The Lazarus Constellation - A study on North-Korean malware

Lexfo lists 23 other indicators in this source. 9 are shown, chosen across types.

All 24 indicators from this source