`66.235.168.238`

66.235.168.238 is an IP address that 6 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Red Asgard, Recorded Future and JPCERT/CC. The earliest of those reports is dated 2026-01-12 and the most recent 2026-11-09.

ip address Contagious Interview Lazarus Group MATCHED IN SOURCE

First seen 2026-01-12 · last seen 2026-11-09

Network

Kind	data centre
Network	Tier.Net Technologies LLC (HopOne Internet Corporation)
Announced by	AS397423 Tier.Net Technologies LLC
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…AS396073 Backup 45.43.11.199 WIN-4MOD9QVI0EN AS397423 (TIER-NET) Router (offline) 66.235.63.55 - AS397423 MetaMask Injector 66.235.168.238 Z238 AS397423 Chrome Stealer C2 45.59.163.55 PS55 AS397423 Chrome Stealer C2 All servers run Windows Server 2019/2022 with…
Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure — Red Asgard · under “Stage 2: Dedicated C2 Servers” · published 2026-01-12 · pulled 2026-09-12
…Domain Vercel C2 (31df390f0305) 11.34.242.92 IP NEW C2 (from deobfuscation) 147.124.212.125 IP Active socket C2 66.235.168.238 IP Active socket C2 45.59.163.55 IP Active socket C2 0xad031E8d8877481337cD53E141C16A2201BB6F4d Polygon Contract DDR #1…
Hunting Lazarus Part II: When the Dead Drop Moved to the Blockchain — Red Asgard · under “Network Indicators” · published 2026-01-23 · pulled 2026-09-12
…APT groups make when they prioritize convenience over compartmentalization. What the Decryption Revealed The decrypted output from 66.235.168.238:22411 contained 6,208 lines of operator beacon data spanning January 29 through February 3, 2026. The beacons show two processes…
Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “What the Decryption Revealed” · published 2026-02-03 · pulled 2026-09-12
…11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.235.175.109 66.235.175.117 67.203.7.163 67.203.7.200 67.203.7.205 88.218.0.78 107.189.24.80 144.172.95.226 144.172.100.124 144.172.100.1…
PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix B: C2 Servers” · published 2026-01-21 · pulled 2026-09-12
…5.61.158.7 45.61.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.1…
Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18
…physical server handles victims from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117,…
Hunting Lazarus Part III: The Infrastructure That Was Too Perfect — Red Asgard · under “Both Families, Same Servers” · published 2026-02-01 · pulled 2026-10-01
…The protocol remained a black box. In wave 24, we cracked it. Server 66.235.168.238:22411 returns 916-byte encrypted streams on connection.…
Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “Wave 24: Breaking the Binary Protocol” · published 2026-02-03 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure

Red Asgard lists 8 other indicators in this source. 5 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: Hunting Lazarus Part II: When the Dead Drop Moved to the Blockchain

Red Asgard lists 7 other indicators in this source. 4 are shown, chosen across types.

All 8 indicators from this source

Cited by the same report: Hunting Lazarus Part IV: Real Blood on the Wire

Red Asgard lists 7 other indicators in this source. 3 are shown, chosen across types.

All 8 indicators from this source