51.195.140.214
51.195.140.214 is an IP address
that 4 published sources report
in connection with IT Worker Fraud and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from tanuki42 (@tanuki42_), Farnsworth Intelligence, Recorded Future and Spur.
The earliest of those reports is dated 2024-12-19 and the most recent 2026-10-18.
The reporting files it under the persona Taro Aikuchi, alongside 24 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
ip address IT Worker FraudContagious Interview MATCHED IN SOURCE
Network
| Kind | Astrill VPN |
|---|---|
| Network | OVH SAS |
| Announced by | AS16276 OVH SAS |
| Country | United Kingdom |
| Flags | hosting range, known proxy or VPN |
Sources
-
Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.
x.com/tanuki42_/status/2044106374054064176 — tanuki42 (@tanuki42_) -
…– Rustdesk logs 173.205.94.156 – Rustdesk logs 83.234.227.36 – Rustdesk logs 38.170.181.10 – Rustdesk logs 209.127.228.186 – Rustdesk logs 51.195.140.214 – Rustdesk logs 207.126.86.121 – Rustdesk logs 51.161.196.51 – Rustdesk logs Mitigation Recommendations: Hand out company laptops…
North Korean ITW IoCs and Mitigation Recommendations — Farnsworth Intelligence -
…1.57 43.230.201.68 45.126.210.144 45.145.68.10 45.250.255.59 45.250.255.140 45.86.208.162 50.2.184.50 50.7.159.34 50.7.251.66 50.118.211.10 51.195.140.214 60.234.42.250 60.249.92.67 61.218.132.193 61.218.138.181 61.219.114.7 61.221.116.19 61.221.116.28 61.221.116.109 63.143.61.57 64.32.17.130…
PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future -
These are the exit addresses of a commercial VPN service with customers everywhere. An address on this list says that a connection came through Astrill, which DPRK IT workers are documented to favour; it does not say who was behind the connection, and the great majority of traffic through these exits is ordinary customers. Treat a match as a reason to look at the account behind it, not as evidence about the person. The list is a snapshot of the addresses active on 19 December 2024; VPN exits are reassigned over time, so an address here may since have been returned to its hosting provider and given to someone else. The list is Spur's and is carried here as published.
Astrill VPN and DPRK Remote Worker Fraud — Spur
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.
Related indicators
Same persona record: Taro Aikuchi
All 24 on the Taro Aikuchi page
Cited by the same report: North Korean ITW IoCs and Mitigation Recommendations
All 15 indicators from this source