`104.168.143.111`

104.168.143.111 is an IP address that 2 published sources report in connection with APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Validin. The earliest of those reports is dated 2025-06-20 and the most recent 2026-04-14.

ip address APT38 MATCHED IN SOURCE

First seen 2025-06-20 · last seen 2026-04-14

Network

Kind	data centre
Network	HostPapa
Announced by	AS54290 HostPapa
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…IP Addresses IP Addresses Copy 104.168.143.111 23.254.167.21 144.172.116.9 108.174.198.11 45.61.157.248 45.61.129.29 144.172.114.220 Table of Contents…
"Hello? I can’t hear you": Investigating UNC1069’s Fake Meeting Tactics — Validin · under “IP Addresses” · published 2026-04-14 · pulled 2026-09-12
…IP Addresses that have been associated with BlueNoroff-associated domains within the last 6 months: IPs Copy 104.168.143.111 147.79.103.251 216.107.137.53 23.254.164.232 23.254.204.184 23.254.244.248 23.254.247.32 23.254.247.53 38.110.228.112 38.146.28.252 45.42.4…
Zooming through BlueNoroff Indicators with Validin — Validin · under “Indicators” · published 2025-06-20 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: "Hello? I can’t hear you": Investigating UNC1069’s Fake Meeting Tactics

Validin lists 6 other indicators in this source.

Cited by the same report: Zooming through BlueNoroff Indicators with Validin

Validin lists 17 other indicators in this source. 6 are shown, chosen across types.

All 18 indicators from this source