← Remote Workers

45.43.11.199

45.43.11.199 is an IP address that 3 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ossprey, Red Asgard and Palo Alto Networks Unit 42. The earliest of those reports is dated 2026-01-12 and the most recent 2026-07-02.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2026-01-12 · last seen 2026-07-02

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• …/24 s as NVISO's published Contagious-Interview C2: our 38.92.47.175 and .157 next door to NVISO's 38.92.47.85 / .91 / .151 , and our 45.43.11.199 a single address from their .201 . For this to be someone else, they would have to be independently abusing the same storage service, with…

  Uncovering a 300+ Package DPRK Contagious Interview Campaign — Ossprey · under “Methodology for attribution” · published 2026-07-02 · pulled 2026-09-02

• …(Majestic Hosting) Primary C2 147.124.212.125 W9_125 AS396073 Secondary C2 216.250.251.87 WIN-8OA3CCQAE4D AS396073 Backup 45.43.11.199 WIN-4MOD9QVI0EN AS397423 (TIER-NET) Router (offline) 66.235.63.55 - AS397423 MetaMask Injector 66.235.168.238 Z238 AS397423 Chrome…

  Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure — Red Asgard · under “Stage 2: Dedicated C2 Servers” · published 2026-01-12 · pulled 2026-09-12

• …7bd7c41bc5b91cced6630cfc64c595ec149c115ad98de1d346d48497b38cefa5 - n.js IP ADDRESSES ASSOCIATED WITH THIS ACTIVITY: - 67.203.7.205 - 45.43.11.199 REPOSITORY ASSOCIATED WITH THIS ACTIVITY: - https://github.com/michalcaladanxyz/caladanecomvp - Note: The repository was active as…

  IOCs for December 2025 Contagious Interview activity — Palo Alto Networks Unit 42 · under “IP ADDRESSES ASSOCIATED WITH THIS ACTIVITY:” · published 2026-02-04 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Uncovering a 300+ Package DPRK Contagious Interview Campaign

Ossprey lists 14 other indicators in this source. 5 are shown, chosen across types.

• ec26774218bc9ba577cab41f108138831165d891e83252cce231a542e797a0d3 file hash
• 45.59.163.198 IP address
• 45.61.150.31 IP address
• https://jsonkeeper.com/b/BADC6 payload URL
• https://jsonkeeper.com/b/UPCMV payload URL

All 15 indicators from this source

Cited by the same report: Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure

Red Asgard lists 8 other indicators in this source. 4 are shown, chosen across types.

• 45.59.163.55 IP address
• 66.235.168.238 IP address
• https://pastebin.com/u/CrackEden1251_WaitsRenee9809 payload URL
• https://pastebin.com/u/KerrWhale2274_KnowNtsc6785 payload URL

All 9 indicators from this source

Cited by the same report: IOCs for December 2025 Contagious Interview activity

Palo Alto Networks Unit 42 lists 2 other indicators in this source.

• https://github.com/michalcaladanxyz GitHub account
• michalcaladanxyz/caladanecomvp malicious repository