← All actor clusters

104.168.203.159

104.168.203.159 is an IP address that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Validin. The report is dated 2024-07-15.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2024-07-15 · last seen 2024-07-15

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …History The subdomains for roomconnect.online (and not the apex domain) used two IP addresses before June 2024: 104.168.137.21 104.168.203.159 Subdomain DNS history shows two distinct periods of activity for this domain. More recently, after a gap ending June 24,…

  Hunting Lazarus: Expanding Indicators with Historic DNS — Validin · under “Building Initial Pivots from DNS History” · published 2024-07-15 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Hunting Lazarus: Expanding Indicators with Historic DNS

Validin lists 7 other indicators in this source.

• 104.168.137.21 IP address
• 104.168.157.45 IP address
• 104.168.165.165 IP address
• 104.168.165.173 IP address
• 104.168.165.203 IP address
• 104.168.203.161 IP address
• 108.174.194.10 IP address