← Remote Workers

44.238.74.84

44.238.74.84 is an IP address that 3 published sources report in connection with Lazarus Group, unclustered DPRK and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Virustotal, Microsoft and JPCERT/CC. The earliest of those reports is dated 2022-09-29 and the most recent 2026-11-09.

ip address Lazarus GroupDPRK (cluster unattributed)Contagious Interview MATCHED IN SOURCE

First seen 2022-09-29 · last seen 2026-11-09

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …137.184.15.189 - dc20873b80f5cd3cf221ad5738f411323198fb83a608a8232504fd2567b14031 143.244.186.68 44.238.74.84 3818527bc78efcece9d9bc87d77efa9450c2ba5c94f8441ea557ba29d865e7d3 147.182.237.105 3.137.98.129…

  Not a dream job: Hunting for malicious job offers from an APT — Virustotal · under “Infrastructure” · published 2022-11-03 · pulled 2026-09-12

• …Weaponized TightVNC Viewer – user interface The malware was configured to send the username and hostname to IP 44.238.74.84 on TCP/22 as part of the victim check-in with the C2 and establish VNC connections to the same IP on port TCP/5900.…

  ZINC weaponizing open-source software — Microsoft · under “Weaponized TightVNC Viewer” · published 2022-09-29 · pulled 2026-09-12

• …6.0.6.0 14.114.114.114 122.224.51.149 81.177.26.27 34.255.217.70 217.8.117.63 87.19.73.8 62.210.130.250 65.19.154.100 1.8.0.0 65.98.83.116 44.238.74.84 198.12.91.160 47.243.229.22 192.210.149.242 207.54.136.33 94.228.169.143 192.3.141.164 112.124.120.200 120.55.196.60 59.46.12.25 193.29.15.…

  Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Not a dream job: Hunting for malicious job offers from an APT

Virustotal lists 5 other indicators in this source.

• 137.184.15.189 IP address
• 143.244.186.68 IP address
• 147.182.237.105 IP address
• 172.93.201.253 IP address
• 3.137.98.129 IP address

Cited by the same report: ZINC weaponizing open-source software

Microsoft lists 10 other indicators in this source. 4 are shown, chosen across types.

• 37e30dc2faaabaf93f0539ffbde032461ab63a2c242fbe6e1f60a22344c8a334 file hash
• 63cddab76e9d63e3cbea421b607342735d924e462c40f3917b1b5fbdf8d4a20d file hash
• 71beb4252e93291c7b14dfcb4cbb5d58144a76181fbe4aab3592121a3dbd9c55 file hash
• aaad412aeb0f98c2c27bb817682f08673902a48b65213091534f96fe6f5494d9 file hash

All 11 indicators from this source

Cited by the same report: Contagious Interview IoCs

JPCERT/CC lists 539 other indicators in this source. 3 are shown, chosen across types.

• 45.130.43.97 IP address
• 45.137.213.30 IP address
• 45.142.211.22 IP address

All 540 indicators from this source