← All actor clusters

172.93.201.253

172.93.201.253 is an IP address that 3 published sources report in connection with Lazarus Group and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Zscaler, Virustotal and Microsoft. The earliest of those reports is dated 2022-04-26 and the most recent 2026-10-18.

ip address Lazarus GroupDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2022-04-26 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

• …If we check the passive DNS data for this domain, we find two other IP address resolutions: 172.93.201.253 in November 2021 and 45.147.231.213 in September 2021. The IP address 172.93.201.253 was recently used to host the domain -…

  Lazarus Group APT Targeting South Korean Users | Zscaler — Zscaler · under “Attribution to Lazarus APT” · published 2022-04-26 · pulled 2026-09-12

• …147.182.237.105 3.137.98.129 cd8e12cddfe71b89597b6621d538b63673c8a8a3bf47a0fa572961ca1280e5b5 137.184.15.189 172.93.201.253 ccdb436a5941ba47a8b7e110021ad98ba6dc4e0296dc973429fc0c73de5e5397 - 44.238.74.84…

  Not a dream job: Hunting for malicious job offers from an APT — Virustotal · under “Infrastructure” · published 2022-11-03 · pulled 2026-09-12

• …It then sends that information to a hardcoded IP 172.93.201.253 over TCP/22, which does not use SSH protocol and does not require SSH handshake to establish communication.…

  ZINC weaponizing open-source software — Microsoft · under “Weaponized KiTTY malware” · published 2022-09-29 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Lazarus Group APT Targeting South Korean Users | Zscaler

Zscaler lists 9 other indicators in this source. 5 are shown, chosen across types.

• kimkl0222@hotmail.com email address
• laris081007@hotmail.com email address
• 210db61d1b11c1d233fd8a0645946074 file hash
• 37505b6ff02a679e70885ccd60c13f3b file hash
• 222.112.127.9 IP address

All 10 indicators from this source

Cited by the same report: Not a dream job: Hunting for malicious job offers from an APT

Virustotal lists 5 other indicators in this source. 4 are shown, chosen across types.

• 137.184.15.189 IP address
• 143.244.186.68 IP address
• 3.137.98.129 IP address
• 44.238.74.84 IP address

All 6 indicators from this source

Cited by the same report: ZINC weaponizing open-source software

Microsoft lists 10 other indicators in this source. 3 are shown, chosen across types.

• 14f736b7df6a35c29eaed82a47fc0a248684960aa8f2222b5ab8cdad28ead745 file hash
• 37e30dc2faaabaf93f0539ffbde032461ab63a2c242fbe6e1f60a22344c8a334 file hash
• 63cddab76e9d63e3cbea421b607342735d924e462c40f3917b1b5fbdf8d4a20d file hash

All 11 indicators from this source