`172.93.201.88`

172.93.201.88 is an IP address that 2 published sources report in connection with Lazarus Group and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from ESET and Wickeren. The earliest of those reports is dated 2025-11-09 and the most recent 2026-11-09.

ip address Lazarus Group APT38 MATCHED IN SOURCE

First seen 2025-11-09 · last seen 2026-11-09

Network

Kind	proxy or VPN
Network	Nexeon Technologies (DataWagon, LLC)
Announced by	AS20278 Nexeon Technologies, Inc.
Country	United States
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

…od.lk Cogent Communications 2023-03-16 Remote OpenDrive storage containing SimplexTea ( /d/NTJfMzg4MDE1NzJf/vxmedia ) 172.93.201.88 journalide.org Nexeon Technologies, Inc.…
Linux malware strengthens links between Lazarus and the 3CX supply-chain attack — ESET · under “Network” · published 2023-04-20 · pulled 2026-09-12
…are attributed to UNC4736 and UNC3782. 2022–04–08 journalide.org UNC4736 2021-11-26 nxmnv.site UNC3782 Table 2: Resolutions for IP 172.93.201.88 In my research, I will uncover unreported domains, IP addresses, and emails from UNC3782. Tool Usage Silent Push Platform Python…
DPRK UNC3782 — Wickeren · under “Background” · published 2025-11-09 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Linux malware strengthens links between Lazarus and the 3CX supply-chain attack

ESET lists 14 other indicators in this source. 7 are shown, chosen across types.

All 15 indicators from this source

Cited by the same report: DPRK UNC3782

Wickeren lists 36 other indicators in this source. 5 are shown, chosen across types.

All 37 indicators from this source