`185.235.241.208`

185.235.241.208 is an IP address that 11 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Threat Intel Report, Logpresso, Unit 42, Group-IB, ESET, NVISO, Threat Book, IGLOO Security, JPCERT/CC and e Sentire. The earliest of those reports is dated 2024-08-19 and the most recent 2026-11-09.

ip address Contagious Interview Lazarus Group MATCHED IN SOURCE

First seen 2024-08-19 · last seen 2026-11-09

Network

Kind	proxy or VPN
Network	WorkTitans B.V
Country	Germany
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

…update ( Unit 42 ) IP 95.164.17.24 Reported BeaverTail and InvisibleFerret C2 Unit 42 Contagious Interview update ( Unit 42 ) IP 185.235.241.208 Reported BeaverTail and InvisibleFerret C2 Unit 42 Contagious Interview update ( Unit 42 ) Domain mirotalk.io Video meeting app themed…
DPRK fake interview lures and recruitment-driven access operations summary — ThreatIntelReport — Threat Intel Report · under “5. Indicators of Compromise (IOCs)” · published 2026-02-25 · pulled 2026-09-09
…IP 주소 1 172.86.84.38 2 45.61.150.31 3 94.131.97.195 4 144.172.97.7 5 185.235.241.208 6 45.61.128.110 7 144.172.86.27 8 185.153.182.241 9 45.137.213.30 10 86.104.74.51 11 45.128.52.14 URL No.…
[위협 분석] 북한 라자루스(Lazarus) 그룹이 배포한 악성 npm 패키지 감염 사례 | 로그프레소 — Logpresso · under “IP” · published 2025-03-17 · pulled 2026-09-12
…IP addresses for BeaverTail & InvisibleFerret C2 servers: 95.164.17.24 185.235.241.208 SHA256 hashes for InvisibleFerret related components: 07183a60ebcb02546c53e82d92da3ddcf447d7a1438496c4437ec06b4d9eb287…
Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware — Unit 42 · under “Indicators of Compromise” · published 2024-10-09 · pulled 2026-09-12
Nearby text:

…of Compromise arrow_drop_down http://23.106.253.194:1244 http://45.140.147.208:54321 http://95.164.17.24:1224 http://185.235.241.208:1224 http://freeconference.io http://mirotalk.net http://ipcheck.cloud http://regioncheck.net Filename SHA256…
APT Lazarus: Eager Crypto Beavers, Video calls and Games | Group-IB Blog — Group-IB · under “Supercharge your cybersecurity with Group-IB Threat Intelligence” · published 2024-09-04 · pulled 2026-09-12
…185.235.241.208 N/A STARK INDUSTRIES SOLUTIONS LTD 2021‑04‑12 BeaverTail/InvisibleFerret C&C and staging server.…
DeceptiveDevelopment targets freelance developers — ESET · under “Network” · published 2025-02-20 · pulled 2026-09-12
…147.124.212.89 147.124.214.129 147.124.214.131 147.124.214.237 165.140.86.227 172.86.84.38 172.86.98.240 185.153.182.241 185.235.241.208 216.126.229.166 23.106.253.194 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.242 23.227.202.244…
Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery — NVISO · under “Indicators of Compromise (IOCs)” · published 2025-11-13 · pulled 2026-09-12
…the background by displaying a video conference window pointing to freeconference.com . 3.3 Malicious code initialization, C2 ( http://185.235.241.208:1224 ), and browser cryptocurrency wallet extension ID. 3.4 Based on the default data storage path of the cryptocurrency wallet…
Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation — Threat Book · under “3. Sample Analysis” · published 2024-10-23 · pulled 2026-09-12
…7 C2 w3capi.marketing 8 C2 payloadrpc.com 9 C2 185.235.241.208:1224 10 C2 45.128.52.14:1224 11 C2 45.159.248.55:1224 5.…
북한 위협 행위자 Contagious Interview 캠페인 분석 — IGLOO Security · under “4. IOC 정보” · published 2025-02-03 · pulled 2026-09-12
….86.109.3 172.86.123.35 172.86.123.55 172.86.66.236 172.86.66.247 172.86.70.173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.22…
Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18
…a cURL command to download InvisibleFerret malware components from a command and control (C2) server; in this case the C2 was located at 185.235.241.208:1224.…
Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2 — e Sentire · under “Execution Chain” · published 2024-11-14 · pulled 2026-10-01
…They increased the number of targeted browser extensions by adding kaikas, rabby, argent X, exodus web3 #beavertail indicators: 185.235.241.208:1224 95.164.17.24:1224 dc77044fe8d35882015eaa99ca31f826 b9693b6541a22d01b100b867375279e6 8ebca0b7ef7dbfc14da3ee39f478e880 ed60b3913e6694f4a…
Group-IB on a Windows BeaverTail and trojanised ReactJS games (archived post) — Group-IB · under “Group-IB researchers noticed a Windows version of #BeaverTail , which was attributed to #Lazarus . We also discovered that the #javascript version of BeaverTail is now being distributed through trojanised games built with ReactJS and distributed as an NPM-based package.” · published 2024-08-19 · pulled 2026-10-02

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: DPRK fake interview lures and recruitment-driven access operations summary — ThreatIntelReport

Threat Intel Report lists 3 other indicators in this source.

Cited by the same report: [위협 분석] 북한 라자루스(Lazarus) 그룹이 배포한 악성 npm 패키지 감염 사례 | 로그프레소

Logpresso lists 10 other indicators in this source. 5 are shown, chosen across types.

All 11 indicators from this source

Cited by the same report: Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware

Unit 42 lists 9 other indicators in this source. 4 are shown, chosen across types.

All 10 indicators from this source