`162.19.71.175`

162.19.71.175 is an IP address that 2 published sources report in connection with Lazarus Group, Andariel and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cisco Talos and Microsoft. The earliest of those reports is dated 2023-12-11 and the most recent 2024-07-25.

ip address Lazarus Group AndarielDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2023-12-11 · last seen 2024-07-25

Network

Kind	proxy or VPN
Network	OVH SAS (OVH)
Announced by	AS16276 OVH SAS
Country	France
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

…IOCs tech.micrsofts.com tech.micrsofts.tech 27.102.113.93 185.29.8.53 155.94.208.209 162.19.71.175 201.77.179.66 http://27.102.113.93/inet.txt http[://]162.19.71.175:7443/sonic/bottom.gif http[://]201.77.179.66:8082/img/lndex.php htt…
Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang — Cisco Talos · under “Network IOCs” · published 2023-12-11 · pulled 2026-09-12
…this query to detect associated network IOCs: let remoteip = dynamic(["84.38.134.56","45.155.37.101","213.139.205.151","109.248.150.147","162.19.71.175","147.78.149.201"]); let remoteurl =…
Onyx Sleet uses array of malware to gather intelligence for North Korea — Microsoft · under “Microsoft Sentinel queries” · published 2024-07-25 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang

Cisco Talos lists 5 other indicators in this source.

Cited by the same report: Onyx Sleet uses array of malware to gather intelligence for North Korea

Microsoft lists 7 other indicators in this source.