`138.201.50.5`

138.201.50.5 is an IP address that 5 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Socket, Cisco Talos, Ransom-ISAC, blog.talosintelligence.com and Cisco Talos (GitHub IOC repository). The earliest of those reports is dated 2025-10-10 and the most recent 2026-10-18.

ip address Contagious Interview Lazarus Group CURATED

First seen 2025-10-10 · last seen 2026-10-18

Network

Kind	data centre
Network	Hetzner Online GmbH (Hetzner)
Announced by	AS24940 Hetzner Online GmbH
Country	Germany
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

Direct-IP command-and-control endpoint listed by Socket for the July to October 2025 Contagious Interview npm wave of 338 packages.
North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads — Socket · published 2025-10-10 · pulled 2026-09-21
…Transfer T1119 — Automated Collection T1657 — Financial Theft Indicators of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244 http://fashdefi.store:6168/defy/v7…
North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads | Socket — Socket · under “C2 Endpoints #” · published 2025-10-10 · pulled 2026-09-01
…In the discovered sample Talos found, the uploading C2 URL was “http[://]138.201.50.5:5961/upload”.…
BeaverTail and OtterCookie evolve with a new Javascript module — Cisco Talos · under “Other OtterCookie modules” · published 2025-10-16 · pulled 2026-09-12
…Notes 23.227.202.244 HVC-AS Similar HTTP headers to socket.io C2 172.86.88.188 ROUTERHOSTING Nothing of significance to mention 138.201.50.5 Hetzner Online GmbH Same ASN as Cluster-3 135.181.123.177 Hetzner Online GmbH Same ASN as Cluster-3 144.172.96.35 ROUTERHOSTING…
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC · under “Source1: Cisco Talos - Beavertail and Ottercookie” · published 2025-11-13 · pulled 2026-09-12
…In the discovered sample Talos found, the uploading C2 URL was “http[://]138.201.50.5:5961/upload”.…
BeaverTail and OtterCookie evolve with a new Javascript module · under “Other OtterCookie modules” · published 2025-10-16 · pulled 2026-09-18
Nearby text:

…8.188:1476/upload http://172.86.88.188/api/service/makelog http://172.86.88.188/api/service/process/c841b6c4ac4d2e83f16cf7a8bfbec3d7 http://138.201.50.5:5961/upload http://135.181.123.177/api/service/makelog http://144.172.96.35/api/service/makelog http://144.172.112.50/api/service/makelog h…
BeaverTail and OtterCookie — Cisco Talos (GitHub IOC repository) · published 2025-10-16 · pulled 2026-09-29

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads

Socket lists 563 other indicators in this source. 7 are shown, chosen across types.

All 564 indicators from this source

Cited by the same report: BeaverTail and OtterCookie evolve with a new Javascript module

Cisco Talos lists 5 other indicators in this source.