← Remote Workers

38.180.88.203

38.180.88.203 is an IP address that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Hayden McKenzie. The report is dated 2026-08-13.

ip address IT Worker Fraud RESEARCHER POST

First seen 2026-08-13 · last seen 2026-08-13

Network

Looked up 2026-09-24 at ip-api.com. A hosting range is not evidence on its own.

Source

• Addresses shown in two screenshots Hayden McKenzie's second report publishes from the operator's archive, dated 23 April 2024: a Cloudzy dashboard (instances named proxy, HNJ-New, HGH and RHS-Alexander, the last a persona name) and an is*hosting server list of five Windows VPSs. The report describes them as the operation's hosting. They are rented addresses and will have been reassigned since.

  haydenmckenzie.com/research/dprk-it-worker-operation-part-two — Hayden McKenzie · under “VPS instances in a DPRK IT-worker operation's own hosting accounts” · published 2026-08-13 · pulled 2026-09-24

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: haydenmckenzie.com/research/dprk-it-worker-operation-part-two

Hayden McKenzie lists 10 other indicators in this source.

• RJM alias
• spring day alias
• 172.86.102.162 IP address
• 172.86.121.135 IP address
• 172.86.96.56 IP address
• 172.86.99.30 IP address
• 205.204.73.37 IP address
• 38.180.61.43 IP address
• 38.180.80.129 IP address
• 38.180.90.209 IP address