67.195.204.56
67.195.204.56 is an IP address
that 2 published sources report
in connection with Lazarus Group, Kimsuky, APT38 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from wezard4u and N3mes1s.
The earliest of those reports is dated 2023-04-26 and the most recent 2026-03-31.
ip address Lazarus GroupKimsukyAPT38Contagious Interview MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | Oath Holdings Inc. |
| Announced by | AS26101 Yahoo Holdings Inc. |
| Country | United States |
| Flags | hosting range |
Sources
-
…(TCP) 23.44.229.223:443 (TCP) 23.62.216.24:443 (TCP) 23.75.68.149:443 (TCP) 255.255.255.255:67 (UDP) 54.189.10.237:443 (TCP) 67.195.204.56:443 (TCP) 67.195.228.56:443 (TCP) 72.21.91.29:80 (TCP) 8.8.8.8:53 (UDP) 2023-04-26 07:53:46 UTC 바이러스토탈(VirusTotal) 기준으로 탐지하는 보안 업체들은 다음과…
북한 라자루스(Lazarus) 산하 BlueNorOff(블루노로프) 만든 맥OS 악성코드-Internal PDF Viewer(2023.4.23) — wezard4u -
…not C2 Akamai fallback IPs Listed as RAT fallback Legitimate CDN nodes — Apple service infrastructure, not attacker-controlled 67.195.204.56 (Yahoo) Listed as suspicious contact Yahoo media router ( media-router-apple71.prod.media.vip.bf1.yahoo.com ) — background traffic…
Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution — N3mes1s
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.
Related indicators
Cited by the same report: 북한 라자루스(Lazarus) 산하 BlueNorOff(블루노로프) 만든 맥OS 악성코드-Internal PDF Viewer(2023.4.23)
All 12 indicators from this source