195.201.104.53
195.201.104.53 is an IP address
that 4 published sources report
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Red Asgard and Expel.
The earliest of those reports is dated 2026-02-28 and the most recent 2026-05-16.
ip address Contagious Interview MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | Hetzner Online GmbH |
| Announced by | AS24940 Hetzner Online GmbH |
| Country | Germany |
| Flags | hosting range |
Sources
-
…in FileZilla's recentservers.xml that had no prior history in our documentation of this operator or this infrastructure cluster. 195.201.104.53 144.172.89.198 216.126.227.239 Before getting to what those entries mean, it is worth explaining what recentservers.xml is.…
Hunting Lazarus, Part 5: Eleven Hours on His Disk — Red Asgard -
…that OtterCookie data eventually fed is deferred to a later article. Where Part VII Left Off Part VII established that 195.201.104.53 , the Hetzner host that earlier parts had described as the FTP exfiltration sink, was running six Express services on non-standard ports…
Hunting Lazarus Part VIII: OtterCookie — Red Asgard -
…VSX extension had been compromised and used to install malware. The malware command-and-control server (C2) listed in the blog is 195.201.104.53 , which belongs to the OtterCookie malware family.…
Inside Lazarus: How North Korea uses AI to industrialize attacks on developers — Expel -
…# hunting-lazarus Hunting Lazarus Part VII: The Server That Was Not Just FTP The Hetzner host at 195.201.104.53 was known as the BeaverTail FTP exfiltration sink.…
Hunting Lazarus Part VII: The Server That Was Not Just FTP — Red Asgard
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.