← Remote Workers

38.180.61.43

38.180.61.43 is an IP address that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Hayden McKenzie. The report is dated 2026-08-13.

ip address IT Worker Fraud RESEARCHER POST

First seen 2026-08-13 · last seen 2026-08-13

Network

Looked up 2026-09-24 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Source

• Addresses shown in two screenshots Hayden McKenzie's second report publishes from the operator's archive, dated 23 April 2024: a Cloudzy dashboard (instances named proxy, HNJ-New, HGH and RHS-Alexander, the last a persona name) and an is*hosting server list of five Windows VPSs. The report describes them as the operation's hosting. They are rented addresses and will have been reassigned since.

  haydenmckenzie.com/research/dprk-it-worker-operation-part-two — Hayden McKenzie · under “VPS instances in a DPRK IT-worker operation's own hosting accounts” · published 2026-08-13 · pulled 2026-09-24

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: haydenmckenzie.com/research/dprk-it-worker-operation-part-two

Hayden McKenzie lists 10 other indicators in this source.

• RJM alias
• spring day alias
• 172.86.102.162 IP address
• 172.86.121.135 IP address
• 172.86.96.56 IP address
• 172.86.99.30 IP address
• 205.204.73.37 IP address
• 38.180.80.129 IP address
• 38.180.88.203 IP address
• 38.180.90.209 IP address