`89.249.65.220`

89.249.65.220 is an IP address that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Norfolk. The report is dated 2019-01-13.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2019-01-13 · last seen 2019-01-13

Network

Kind	proxy or VPN
Network	M247 Europe SRL (M247 LTD)
Announced by	AS9009 M247 Europe SRL
Country	Germany
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Source

…The alert included two IP addresses (38.132.124.250, 89.249.65.220) as well as two files: syschk.ps1 MD5: 26466867557f84dd4784845280da1f27 SHA1: ed7fcb9023d63cd9367a3a455ec94337bb48628a SHA256:…
Recent Lazarus Tools — Norfolk · under “Vietnam VNCert Alert” · published 2019-01-13 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Recent Lazarus Tools

Norfolk lists 1 other indicator in this source.