← Remote Workers

45.59.163.198

45.59.163.198 is an IP address that 2 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ossprey and Sonatype. The earliest of those reports is dated 2026-06-03 and the most recent 2026-07-02.

ip address Contagious InterviewLazarus Group MATCHED IN SOURCE

First seen 2026-06-03 · last seen 2026-07-02

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …port-1244 Node RAT again, the same /s/<id> beacon and ZT3 handshake from the previous section, pointing at a C2 we had not seen before: 45.59.163.198 . CWOV9 is a one-shot downloader.…

  Uncovering a 300+ Package DPRK Contagious Interview Campaign — Ossprey · under “Caught in the act: a live npm dropper” · published 2026-07-02 · pulled 2026-09-02

• …Look for the indicators of compromise listed above, including www.jsonkeeper.com payload URLs, command-and-control traffic to 45.59.163.198:1244 , and unexpected .vscode files in user home directories.…

  Lazarus Group's Brandjacking Campaign on npm: How to Protect Your Code — Sonatype · under “Recommended Actions” · published 2026-06-03 · pulled 2026-09-11

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Uncovering a 300+ Package DPRK Contagious Interview Campaign

Ossprey lists 14 other indicators in this source. 12 are shown, chosen across types.

• ec26774218bc9ba577cab41f108138831165d891e83252cce231a542e797a0d3 file hash
• 138.201.140.23 IP address
• 146.70.253.107 IP address
• 216.126.225.104 IP address
• 216.126.225.83 IP address
• 23.227.202.244 IP address
• 38.92.47.175 IP address
• 45.61.150.31 IP address
• 5.253.43.122 IP address
• 88.218.0.78 IP address
• https://jsonkeeper.com/b/BADC6 payload URL
• https://jsonkeeper.com/b/UPCMV payload URL

All 15 indicators from this source