`155.138.219.140`

155.138.219.140 is an IP address that 2 published sources report in connection with APT38, Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Sekoia and 安恒信息. The earliest of those reports is dated 2022-08-17 and the most recent 2023-05-22.

ip address APT38 Contagious Interview Lazarus Group MATCHED IN SOURCE

First seen 2022-08-17 · last seen 2023-05-22

Network

Kind	data centre
Network	The Constant Company (Vultr Holdings, LLC)
Announced by	AS20473 The Constant Company, LLC
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…- 2022-11-11) 152.89.247.87 (2022-09-15 - 2022-10-24) 104.168.174.80 (2022-06-28 - 2022-09-16) 149.248.52.31 (2022-08-05 - 2022-08-31) 155.138.219.140 (2022-07-17 - 2022-08-16) YARA rules rule apt_Bluenoroff_downloader_mac_RustBucket { meta: id…
Bluenoroff’s RustBucket campaign — Sekoia · under “Inactive servers” · published 2023-05-22 · pulled 2026-09-12
…本次分析过程中所涉及到的域名，注册商全部为Porkbun：通过这些域名，可以关联到IP地址155.138.219.140，多个该组织使用的域名都可关联到该IP地址：…
虚拟货币收割机：Lazarus APT组织近期不断攻击加密货币行业 - 安恒威胁情报中心 — 安恒信息 · under “关联分析” · published 2022-08-17 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Bluenoroff’s RustBucket campaign

Sekoia lists 18 other indicators in this source. 7 are shown, chosen across types.

All 19 indicators from this source

Cited by the same report: 虚拟货币收割机：Lazarus APT组织近期不断攻击加密货币行业 - 安恒威胁情报中心

安恒信息 lists 31 other indicators in this source. 5 are shown, chosen across types.

All 32 indicators from this source