← Remote Workers

188.43.235.177

188.43.235.177 is an IP address that 3 published sources report in connection with IT Worker Fraud, Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from tayvano (lazarus-bluenoroff-research), Kudelski Security Research and Kudelski Security. The earliest of those reports is dated 2026-09-01 and the most recent 2026-10-18.

ip address IT Worker FraudContagious InterviewLazarus Group MATCHED IN SOURCE

First seen 2026-09-01 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• …blockchainstar18@gmail.com - x.com/blockchain41673/ - t.me/bcstar18 (ID: 5915387318) • [Messages](./user-5915387318-@bcstar18.txt) - 188.43.235.177 Mar 2022 - 188.43.33.249 Sept 2024 - 83.234.227.52 Dec 2024 - 0x73Fd6C969514Cb6bE9BB9620Eaf79Cbda5887fb4 -…

  DPRK IT Workers — tayvano (lazarus-bluenoroff-research) · under “Alexandru-Gabriel Dumitras” · published 2025-06-19 · pulled 2026-09-01

• …We observed that they use IPs belonging to the Vladivostok, Far East division of Mobile Telesystems PJSC as an exit node. 188.43.235.177 DZHV-gw.transtelecom.net As this is linked to a train company, it will not be changed by the DPRK ITW network team.…

  Kudelski Security Research — Kudelski Security Research · under “Tracking Public-Facing IP Addresses” · published 2025-03-05 · pulled 2026-09-10

• …We observed that they use IPs belonging to the Vladivostok, Far East division of Mobile Telesystems PJSC as an exit node. 188.43.235.177 DZHV-gw.transtelecom.net As this is linked to a train company, it will not be changed by the DPRK ITW network team.…

  DPRK Fake IT Workers: Inside Their Evolving Network Infrastructure - Kudelski Security Research Center — Kudelski Security · under “Tracking Public-Facing IP Addresses” · published 2026-07-17 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: DPRK IT Workers

tayvano (lazarus-bluenoroff-research) lists 854 other indicators in this source. 5 are shown, chosen across types.

• https://calendly.com/zerobit417 Calendly account
• https://dev.to/scott_brown_b611d05a865cf DEV Community account
• topfirepassion@gmail.com email address
• https://fiverr.com/derekmiller03 Fiverr account
• 188.43.33.249 IP address

All 855 indicators from this source

Cited by the same report: Kudelski Security Research

Kudelski Security Research lists 66 other indicators in this source. 4 are shown, chosen across types.

• AS8359 autonomous system number
• env-check.daemontools.cc domain
• expressvpn2021-3@outlook.com email address
• 07d889e2dadce6f3910dcbc253317d28ca61c766 file hash

All 67 indicators from this source

Cited by the same report: DPRK Fake IT Workers: Inside Their Evolving Network Infrastructure - Kudelski Security Research Center

Kudelski Security lists 23 other indicators in this source. 3 are shown, chosen across types.

• kut@star-co.net.kp email address
• 188.43.33.253 IP address
• 80.83.238.59 IP address

All 24 indicators from this source