← All actor clusters

197.231.221.211

197.231.221.211 is an IP address that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from SOCRadar. The report is dated 2021-12-02.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2021-12-02 · last seen 2021-12-02

Network

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Source

• …Appendix 3. IoCs of Wannacry IP Addresses and Domains IPv4 197.231.221.211 IPv4 128.31.0.39 IPv4 149.202.160.69 IPv4 46.101.166.19 IPv4 91.121.65.179 URL http://www.btcfrog.com/qr/bitcoinpng.php?address URL…

  APT Profile: Who is Lazarus Group? — SOCRadar · under “IoCs of Wannacry” · published 2021-12-02 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: APT Profile: Who is Lazarus Group?

SOCRadar lists 74 other indicators in this source. 12 are shown, chosen across types.

• 09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa file hash
• 0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894 file hash
• 11d0f63c06263f50b972287b4bbd1abe0089bc993f73d75768b6b41e3d6f6d49 file hash
• 149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff file hash
• 16493ecc4c4bc5746acbe96bd8af001f733114070d694db76ea7b5a0de7ad0ab file hash
• 190d9c3e071a38cb26211bfffeb6c4bb88bd74c6bf99db9bb1f084c6a7e1df4e file hash
• 128.31.0.39 IP address
• 149.202.160.69 IP address
• 46.101.166.19 IP address
• 91.121.65.179 IP address
• 34VXKa5upLWVYMXmgid6bFM4BaQXHxSUoL cryptocurrency wallet address
• 3NbdrezMzAVVfXv5MTQJn4hWqKhYCTCJoB cryptocurrency wallet address

All 75 indicators from this source