`85.239.62.36`

85.239.62.36 is an IP address that 3 published sources report in connection with Lazarus Group, Contagious Interview and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ransom-ISAC, Trend Micro and OpenSourceMalware. The earliest of those reports is dated 2025-11-13 and the most recent 2026-10-30.

ip address Lazarus Group Contagious Interview PolinRider MATCHED IN SOURCE

First seen 2025-11-13 · last seen 2026-10-30

Network

Kind	data centre
Network	Clouvider Limited (JSC "TIMEWEB")
Announced by	AS62240 Clouvider
Country	United Kingdom
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…Oct 2025 ACTIVE 27017 Cluster-1 HIGH 154.91.0.103 149440 Evoxt Enterprise Feb 2025 Mar 2025 27017 , 5432, 1433 Cluster-2 MEDIUM 85.239.62.36 62240 Clouvider Limited May 2025 June 2025 27017 Cluster-2 MEDIUM 85.239.60.213 62240 Clouvider Limited Feb 2025 Feb 2025 27017, 80…
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC · under “Infrastructure Fingerprints” · published 2025-11-13 · pulled 2026-09-12
…Void Dokkaebi C2 eventSubId: (204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available for TrendAI Vision One™ with Threat Intelligence…
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories — Trend Micro · under “Conclusion” · published 2026-04-21 · pulled 2026-09-12
…The RAT connects to a Socket.IO server at 85.239.62.36:3306 , a port usually used by MySQL.…
Earliest Known PolinRider Malware Found in 2025 npm Packages | OpenSourceMalware — OpenSourceMalware · under “Stage 4A Node.js RAT” · published 2026-10-30 · pulled 2026-11-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1)

Ransom-ISAC lists 131 other indicators in this source. 5 are shown, chosen across types.

All 132 indicators from this source

Cited by the same report: Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Trend Micro lists 3 other indicators in this source.

Cited by the same report: Earliest Known PolinRider Malware Found in 2025 npm Packages | OpenSourceMalware

OpenSourceMalware lists 2 other indicators in this source.