3.90.97.16
3.90.97.16 is an IP address
that 3 published sources report
in connection with Lazarus Group activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from JPCERT/CC.
The earliest of those reports is dated 2021-03-21 and the most recent 2021-11-24.
ip address Lazarus Group MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | Amazon Technologies Inc. |
| Announced by | AS14618 Amazon.com, Inc. |
| Country | United States |
| Flags | hosting range |
Sources
-
…NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3) Host: 3.90.97.16 Content-Length: 0 Proxy-Connection: Keep-Alive Pragma: no-cache Although it is a HTTP POST request, it does not contain any data to send.…
Lazarus Attack Activities Targeting Japan (VSingle/ValeforBeta) — JPCERT/CC -
…NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3) Host: 3.90.97.16 Content-Length: 0 Proxy-Connection: Keep-Alive Pragma: no-cache Base64 データ “[8 文字のランダムな文字列 ][ データ ][ ランダム文字列 (4-12 文字 )]" [ データ ]…
The Lazarus Group's Attack Operations Targeting Japan (CODE BLUE 2021) — JPCERT/CC -
…NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3) Host: 3.90.97.16 Content-Length: 0 Proxy-Connection: Keep-Alive Pragma: no-cache Base64 data "[8-letter random string][ data ][random string (4-12…
Anatomy of COBRA (HITCON 2021) — JPCERT/CC
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.