67.203.123.171

67.203.123.171 is an IP address that 2 published sources report in connection with Lazarus Group and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Threat Book and JPCERT/CC. The earliest of those reports is dated 2026-09-12 and the most recent 2026-11-09.

ip address Lazarus GroupContagious Interview MATCHED IN SOURCE

First seen 2026-09-12 · last seen 2026-11-09

Network

Kindfixed line
NetworkHFA Specialty Assets LLC
CountryUnited States

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

  • …45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61.160.14 45.61.169.187 45.61.169.99 45.89.53.59 46.4.224.205 67.203.0.152 67.203.123.171 67.203.6.171 67.203.7.163 67.203.7.171 67.203.7.245 77.37.37.81 91.92.120.135 95.164.17.24 blocktestingto.com de.ztec.store…
    Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation — Threat Book · under “Appendix - IOC” · published 2024-10-23 · pulled 2026-09-12
  • …1.169.99 45.82.255.2 45.83.140.231 45.89.53.54 45.89.53.59 46.4.224.205 5.253.43.122 5.89.53.54 65.140.86.227 66.235.168.232 66.235.168.238 67.203.123.171 67.203.7.163 67.203.7.171 67.203.7.200 67.203.7.209 67.203.7.245 69.197.164.117 74.119.194.129 86.104.74.51 88.218.0.78 91.198.66.112 91.19…
    Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation

Threat Book lists 40 other indicators in this source. 7 are shown, chosen across types.

All 41 indicators from this source

Cited by the same report: Contagious Interview IoCs

JPCERT/CC lists 539 other indicators in this source. 5 are shown, chosen across types.

All 540 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.