← Remote Workers

211.21.6.181

211.21.6.181 is an IP address that 2 published sources report in connection with IT Worker Fraud and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Sekoia.io Threat Detection & Research / Kudelski Security and Recorded Future. The earliest of those reports is dated 2026-09-07 and the most recent 2026-10-18.

ip address IT Worker FraudContagious Interview MATCHED IN SOURCE

First seen 2026-09-07 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• …38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious Interview (Recorded Future) Recorded Future 45.86.208.162 70.32.3.15 Contagious…

  Beyond Lazarus: How North Korea Organizes Its Cyber Operations — Sekoia.io Threat Detection & Research / Kudelski Security · under “Annex 2 - Overlap between fake IT workers and DPRK offensive campaigns” · published 2026-09-07 · pulled 2026-09-09

• …13.31 202.87.221.237 204.44.96.131 204.152.202.111 205.234.203.122 206.206.127.135 208.98.44.2 208.115.228.234 209.127.228.186 211.21.6.136 211.21.6.181 211.22.147.226 211.22.184.184 211.72.35.109 211.72.35.118 211.72.116.247 211.75.42.136 211.75.74.223 212.129.10.242 216.45.56.2 216.227.145…

  PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix C: Astrill VPN Nodes” · published 2026-01-21 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Beyond Lazarus: How North Korea Organizes Its Cyber Operations

Sekoia.io Threat Detection & Research / Kudelski Security lists 12 other indicators in this source. 7 are shown, chosen across types.

• 23.237.102.130 IP address
• 37.120.154.98 IP address
• 38.75.137.97 IP address
• 45.86.208.162 IP address
• 50.7.159.34 IP address
• 66.118.255.35 IP address
• 70.32.3.15 IP address

All 13 indicators from this source

Cited by the same report: PurpleBravo’s Targeting of the IT Software Supply Chain

Recorded Future lists 216 other indicators in this source. 5 are shown, chosen across types.

• hundredup2023@gmail.com email address
• ricogonzalez1013@gmail.com email address
• techsavvy001013@outlook.com email address
• 211.22.147.226 IP address
• 211.22.184.184 IP address

All 217 indicators from this source