← All actor clusters

104.168.165.173

104.168.165.173 is an IP address that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Validin. The report is dated 2024-07-15.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2024-07-15 · last seen 2024-07-15

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

• …Additionally, these IP addresses are net-new to our current search for Lazarus indicators: 104.168.203.161 104.168.165.203 104.168.165.173 104.168.165.165 Second-order Pivots through IP Addresses We can repeat the process from the beginning for each new domain…

  Hunting Lazarus: Expanding Indicators with Historic DNS — Validin · under “Pivoting on Certificate Hash” · published 2024-07-15 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Hunting Lazarus: Expanding Indicators with Historic DNS

Validin lists 7 other indicators in this source.

• 104.168.137.21 IP address
• 104.168.157.45 IP address
• 104.168.165.165 IP address
• 104.168.165.203 IP address
• 104.168.203.159 IP address
• 104.168.203.161 IP address
• 108.174.194.10 IP address