← All actor clusters

185.142.236.213

185.142.236.213 is an IP address that 3 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kaspersky Securelist and CISA. The earliest of those reports is dated 2018-08-23 and the most recent 2021-04-15.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2018-08-23 · last seen 2021-04-15

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …The server hosting celasllc.com (185.142.236.213) belongs to the Blackhost ISP in the Netherlands. WHOIS record of cellasllc.com server Coincidentally, the Fallchill malware authors…

  Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware | Securelist — Kaspersky Securelist · under “Infrastructure” · published 2018-08-23 · pulled 2026-09-11

• …Protocol (IP) addresses from May 29, 2018, to January 23, 2021. 45.199.63.220 107.187.66.103 145.249.106.19 175.29.32.160 185.142.236.213 185.181.104.82 198.251.83.27 208.91.197.46 209.99.64.18 The celasllc.com domain had a valid Sectigo (previously known as…

  AppleJeus: Analysis of North Korea’s Cryptocurrency Malware | CISA — CISA · under “Introduction and Infrastructure” · published 2021-04-15 · pulled 2026-09-11

• …celasllc.com/checkupdate.php Whois Whois for celasllc.com had the following information in August 2018: IP Address: 185.142.236.213 Registrant Name: John Broox Registrant Organization: Registrant Street: 2141 S Archer Ave Registrant City: Chicago Registrant…

  MAR-10322463-1.v1 - AppleJeus: Celas Trade Pro | CISA — CISA · under “Whois” · published 2021-02-17 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware | Securelist

Kaspersky Securelist lists 20 other indicators in this source. 5 are shown, chosen across types.

• AS29073 autonomous system number
• AS3741 autonomous system number
• johnbroox200@gmail.com email address
• 6cb34af551b3fb63df6c9b86900cf044 file hash
• 185.142.236.226 IP address

All 21 indicators from this source

Cited by the same report: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware | CISA

CISA lists 27 other indicators in this source. 4 are shown, chosen across types.

• 185.181.104.82 IP address
• 198.187.29.20 IP address
• 198.251.83.27 IP address
• 198.54.114.175 IP address

All 28 indicators from this source

Cited by the same report: MAR-10322463-1.v1 - AppleJeus: Celas Trade Pro | CISA

CISA lists 26 other indicators in this source. 3 are shown, chosen across types.

• julyighor@gmail.com email address
• 15062b26d9dd1cf7b0cdf167f4b37cb632ddbd41 file hash
• 1e8a2f1f751e5a9931bca5710b4f304798d665dc file hash

All 27 indicators from this source