← Remote Workers

172.86.108.47

172.86.108.47 is an IP address that 2 published sources report in connection with APT38, Contagious Interview and Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Rewterz and SentinelOne. The earliest of those reports is dated 2024-11-07 and the most recent 2024-11-08.

ip address APT38Contagious InterviewKimsuky MATCHED IN SOURCE

First seen 2024-11-07 · last seen 2024-11-08

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …IP 45.61.140.26 23.254.253.75 45.61.128.122 45.61.135.105 144.172.74.23 144.172.74.141 172.86.108.47 216.107.136.10 MD5 529fe6eff1cf452680976087e2250c02 SHA-256 bd2aa5805b76f272b43a595b3d73e29d0fc4647e15e87950b8f904ea26dcf053…

  North Korean Threat Actors Deploy Hidden Risk Malware on macOS to Target Crypto Firms - Active IOCs - Rewterz — Rewterz · under “IP” · published 2024-11-08 · pulled 2026-09-12

• …as Validin, we can identify clear relations between the initial stage 1 delivery domain ( matuaner.com ) and the IPs 45.61.135.105 and 172.86.108.47 .…

  BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence | SentinelOne — SentinelOne · under “Network Infrastructure” · published 2024-11-07 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: North Korean Threat Actors Deploy Hidden Risk Malware on macOS to Target Crypto Firms - Active IOCs - Rewterz

Rewterz lists 10 other indicators in this source. 7 are shown, chosen across types.

• 529fe6eff1cf452680976087e2250c02 file hash
• 7e07765bf8ee2d0b2233039623016d6dfb610a6d file hash
• bd2aa5805b76f272b43a595b3d73e29d0fc4647e15e87950b8f904ea26dcf053 file hash
• 216.107.136.10 IP address
• 23.254.253.75 IP address
• 45.61.128.122 IP address
• 45.61.135.105 IP address

All 11 indicators from this source

Cited by the same report: BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence | SentinelOne

SentinelOne lists 10 other indicators in this source. 5 are shown, chosen across types.

• 05c178891ca1e65af53bbcfdbec573da3f74d176 file hash
• 139.99.66.103 IP address
• 144.172.74.141 IP address
• 144.172.74.23 IP address
• 45.61.140.26 IP address

All 11 indicators from this source