`52.87.80.2`

52.87.80.2 is an IP address that one published source reports in connection with APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from 0x0v1. The report is dated 2024-03-01.

ip address APT37 MATCHED IN SOURCE

First seen 2024-03-01 · last seen 2024-03-01

Network

Kind	data centre
Network	Amazon.com, Inc. (AWS EC2 (us-east-1))
Announced by	AS14618 Amazon.com, Inc.
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

…Reflective DLL Injection, HWP Object Linking and Embedding, BAT Scripts Infrastructure: - https://.work3.b4a.app/ - Amazon hosted stager 52.87.80.2 "HTTP/1.1 401 Unauthorized Date: Mon, 08 Aug 2022 14:14:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 24 Connection:…
RE:archive | APT37's ROKRAT HWP Object Linking and Embedding — 0x0v1 · under “RE:archive” · published 2024-03-01 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: RE:archive | APT37's ROKRAT HWP Object Linking and Embedding

0x0v1 lists 2 other indicators in this source.