Chollima Hunter

← Remote Workers

135.181.123.177

135.181.123.177 is an IP address that 10 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Socket, Veracode, Cisco Talos, NTT Security Japan, Ransom-ISAC, GBHackers on Security, blog.talosintelligence.com, Cisco Talos (GitHub IOC repository), ANY.RUN and Bitso. The earliest of those reports is dated 2025-04-11 and the most recent 2026-10-18.

ip address Contagious InterviewLazarus Group CURATED

First seen 2025-04-11 · last seen 2026-10-18

Network

Kinddata centre
NetworkHetzner Online GmbH
Announced byAS24940 Hetzner Online GmbH
CountryFinland
Flagshosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

  • Direct-IP command-and-control endpoint listed by Socket for the July to October 2025 Contagious Interview npm wave of 338 packages.
    North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads — Socket · published 2025-10-10 · pulled 2026-09-21
  • …— Ingress Tool Transfer T1119 — Automated Collection T1657 — Financial Theft Indicators of Compromise (IOCs) # C2 Endpoints # 135.181.123.177 138.201.50.5 144.172.105.235 144.172.112.106 146.70.253.107 23.127.202.249 23.227.202.244…
    North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads | Socket — Socket · under “C2 Endpoints #” · published 2025-10-10 · pulled 2026-09-01
  • …this time we observed: http://144.172.105.235:1224/pdown – the same C2 we saw in cloud-binary , including the same C2 WebSocket: http://135.181.123.177/api/service/makelog . This package was found to contain two Beavertail configurations. Hunting for Other Packages We notified NPM of…
    North Korean Crypto Stealing Campaign Rears Its Head Again — Veracode · under “Something Fishing About nodemailer-enhancer” · published 2025-07-31 · pulled 2026-09-09
  • …http[://]172.86.88.188/api/service/process/c841b6c4ac4d2e83f16cf7a8bfbec3d7 http[://]138.201.50.5:5961/upload http[://]135.181.123.177/api/service/makelog http[://]144.172.96.35/api/service/makelog http[://]144.172.112.50/api/service/makelog http[://]172.86.73.46…
    BeaverTail and OtterCookie evolve with a new Javascript module — Cisco Talos · under “IOCs” · published 2025-10-16 · pulled 2026-09-12
  • …通信先 alchemy-api-v3.cloud chainlink-api-v3.cloud moralis-api-v3.cloud modilus.io 116.202.208.125 65.108.122.31 194.164.234.151 135.181.123.177 188.116.26.84 65.21.23.63 95.216.227.188 記事をシェアする 前の記事 【徹底比較】MDRとSOCの違いとは？自社に最適な選び方を解説 Additional Features of…
    WaterPlumが使用するマルウェアOtterCookieの機能追加 — NTT Security Japan · under “IoCs” · published 2025-05-08 · pulled 2026-09-12
  • …C2 172.86.88.188 ROUTERHOSTING Nothing of significance to mention 138.201.50.5 Hetzner Online GmbH Same ASN as Cluster-3 135.181.123.177 Hetzner Online GmbH Same ASN as Cluster-3 144.172.96.35 ROUTERHOSTING Historically hosted on PONYNET 144.172.112.50 ROUTERHOSTING…
    Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC · under “Source1: Cisco Talos - Beavertail and Ottercookie” · published 2025-11-13 · pulled 2026-09-12
  • …name: CoinLocator-main coin-promoting-app-main 0xhpenvynb-mvp_gamba-6b10f2e9dd85 IP: 144.172.96.35 107.189.24.80 135.181.123.177 Favicon Hash: 41ee7ddb2be173686dc3a73a49b4e93bc883ef363acca770f7ede891451122ab Find this Story Interesting! Follow us on LinkedIn and…
    Lazarus Group Enhances Malware with New OtterCookie Payload Delivery Technique — GBHackers on Security · under “IP:” · published 2025-07-30 · pulled 2026-09-12
  • …http[://]172.86.88.188/api/service/process/c841b6c4ac4d2e83f16cf7a8bfbec3d7 http[://]138.201.50.5:5961/upload http[://]135.181.123.177/api/service/makelog http[://]144.172.96.35/api/service/makelog http[://]144.172.112.50/api/service/makelog http[://]172.86.73.46…
    BeaverTail and OtterCookie evolve with a new Javascript module · under “IOCs” · published 2025-10-16 · pulled 2026-09-18

  • Nearby text:

    …88.188/api/service/makelog http://172.86.88.188/api/service/process/c841b6c4ac4d2e83f16cf7a8bfbec3d7 http://138.201.50.5:5961/upload http://135.181.123.177/api/service/makelog http://144.172.96.35/api/service/makelog http://144.172.112.50/api/service/makelog http://172.86.73.46 http://135.181.1…
    BeaverTail and OtterCookie — Cisco Talos (GitHub IOC repository) · published 2025-10-16 · pulled 2026-09-29
  • …Register now with a business email to try ANY.RUN → Gathered IOCs IPv4: 135.181.123.177 IPv4: 144.172.101.45 Domain: chainlink-api-v3.cloud URL: http://144.172.101.45:1224/ URL:…
    OtterCookie: Analysis of New Lazarus Group Malware — ANY.RUN · under “Gathered IOCs” · published 2025-06-03 · pulled 2026-10-01
  • …But, my friends, the hunting season never ends … Indicators of Compromise IPv4:135.181.123.177 Domain:chainlink-api-v3.cloud URL:http://chainlink-api-v3.cloud/api/service/token/56e15ef3b5e5f169fc063f8d3e88288e URL:http://chainlink-api…
    Interview with the Chollima — Bitso · under “Indicators of Compromise” · published 2025-04-11 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads

Socket lists 563 other indicators in this source. 7 are shown, chosen across types.

All 564 indicators from this source

Cited by the same report: North Korean Crypto Stealing Campaign Rears Its Head Again

Veracode lists 8 other indicators in this source. 5 are shown, chosen across types.

All 9 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.