`45.59.163.55`

45.59.163.55 is an IP address that 6 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from ENKI and Red Asgard. The earliest of those reports is dated 2026-01-12 and the most recent 2026-02-27.

ip address Contagious Interview Lazarus Group MATCHED IN SOURCE

First seen 2026-01-12 · last seen 2026-02-27

Network

Kind	data centre
Network	Tier.Net Technologies LLC
Announced by	AS397423 Tier.Net Technologies LLC
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…IPv4 147.124.213.232 2026-01-12 2026-02-26 IPv4 216.250.251.87 2026-01-12 2026-02-26 IPv4 45.59.163.55 2026-01-12 2026-02-26 IPv4 66.235.175.109 2025-11-13 2026-02-26 Related Actors…
Contagious Interview Campaign Abusing VSCode Distributed on Github - ENKI | lazarus.day — ENKI · under “Indicators of Compromise” · published 2026-02-26 · pulled 2026-09-01
…AS397423 (TIER-NET) Router (offline) 66.235.63.55 - AS397423 MetaMask Injector 66.235.168.238 Z238 AS397423 Chrome Stealer C2 45.59.163.55 PS55 AS397423 Chrome Stealer C2 All servers run Windows Server 2019/2022 with Express.js on port 1244, pyftpdlib FTP on port 21, and…
Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure — Red Asgard · under “Stage 2: Dedicated C2 Servers” · published 2026-01-12 · pulled 2026-09-12
…11.34.242.92 IP NEW C2 (from deobfuscation) 147.124.212.125 IP Active socket C2 66.235.168.238 IP Active socket C2 45.59.163.55 IP Active socket C2 0xad031E8d8877481337cD53E141C16A2201BB6F4d Polygon Contract DDR #1 0xa80db78ff597c3D34cCAF3bdaC39f3E193595561…
Hunting Lazarus Part II: When the Dead Drop Moved to the Blockchain — Red Asgard · under “Network Indicators” · published 2026-01-23 · pulled 2026-09-12
…C2 Active 147.124.214.129 1244 BeaverTail victim C2 Active 66.235.168.238 1244, 22411-22413 BeaverTail + binary protocol Active 45.59.163.55 1244 BeaverTail victim C2 Active 216.250.251.87 1247 BeaverTail backup Active 172.86.105.40 5918 OtterCookie victim C2 Active…
Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “IP Addresses” · published 2026-02-03 · pulled 2026-09-12
…IDs are: nkbihfbeogaeaoehlefnkodbefgpgknn acmacodkjbdgmoleebolmdjonilkdbch After deletion, it downloads a payload from http://45.59.163.55:1244/mmz/[Extension ID]_knHbMe8 and extracts it into the now-empty extension directories.…
Contagious Interview Campaign Abusing VSCode Distributed on Github — ENKI · under “mc” · published 2026-02-27 · pulled 2026-09-12
…handles victims from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45…
Hunting Lazarus Part III: The Infrastructure That Was Too Perfect — Red Asgard · under “Both Families, Same Servers” · published 2026-02-01 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Contagious Interview Campaign Abusing VSCode Distributed on Github - ENKI | lazarus.day

ENKI lists 14 other indicators in this source. 5 are shown, chosen across types.

All 15 indicators from this source

Cited by the same report: Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure

Red Asgard lists 8 other indicators in this source. 4 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: Hunting Lazarus Part II: When the Dead Drop Moved to the Blockchain

Red Asgard lists 7 other indicators in this source. 3 are shown, chosen across types.

All 8 indicators from this source