← Remote Workers

23.106.253.209

23.106.253.209 is an IP address that 3 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from veryserious.systems, Threat Book and JPCERT/CC. The earliest of those reports is dated 2026-06-13 and the most recent 2026-11-09.

ip address Contagious InterviewLazarus Group MATCHED IN SOURCE

First seen 2026-06-13 · last seen 2026-11-09

Network

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

• …167.88.160.106 — FOFA tracking 45.61.131.218 — Travis Mathison 45.61.169.99 — Travis Mathison 23.106.253.194 — Travis Mathison 23.106.253.209 — Travis Mathison 144.172.105.235 — Socket.dev 172.86.98.240 1224, 1244 Travis Mathison 172.86.80.145 1224 Travis Mathison…

  Breaking down North Korea's continuation of BeaverTail — veryserious.systems · under “Breaking down North Korea's continuation of the BeaverTail campaign” · published 2026-06-13 · pulled 2026-09-09

• …67.88.168.152 167.88.168.24 172.86.100.168 172.86.123.35 172.86.97.80 172.86.98.240 173.211.106.101 185.235.241.208 23.106.253.194 23.106.253.209 23.106.253.215 23.106.70.154 23.254.244.242 45.140.147.208 45.61.129.255 45.61.130.0 45.61.131.218 45.61.158.54 45.61.158.7 45.61…

  Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation — Threat Book · under “Appendix - IOC” · published 2024-10-23 · pulled 2026-09-12

• …173 172.86.93.139 172.86.98.240 173.211.106.101 185.153.182.241 185.235.241.208 191.96.31.38 195.201.172.170 216.126.229.166 23.106.253.194 23.106.253.209 23.106.253.215 23.106.253.221 23.106.253.242 23.106.70.154 23.227.202.244 38.92.47.151 38.92.47.85 38.92.47.91 45.128.52.14 45.130.43.97 45…

  Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Breaking down North Korea's continuation of BeaverTail

veryserious.systems lists 12 other indicators in this source. 5 are shown, chosen across types.

• 2956b023858d706a5e241cd28b845088e5f414c5f70bd5d8cb73cb427d081065 file hash
• 37e9dde0f35864e2ea8dcd4c8b5324ef50e3798195d04c30ba6938352af702db file hash
• 144.172.105.235 IP address
• 45.61.131.218 IP address
• 45.61.169.99 IP address

All 13 indicators from this source

Cited by the same report: Lazarus' Espionage-related Cryptocurrency Activities Remain Active, With A Significant Amount of Assets Still in Circulation

Threat Book lists 40 other indicators in this source. 4 are shown, chosen across types.

• 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 file hash
• 5cce14436b3ae5315feec2e12ce6121186f597b3 file hash
• 23.106.253.215 IP address
• 23.106.70.154 IP address

All 41 indicators from this source

Cited by the same report: Contagious Interview IoCs

JPCERT/CC lists 539 other indicators in this source. 3 are shown, chosen across types.

• 23.106.253.221 IP address
• 23.106.253.242 IP address
• 23.108.108.42 IP address

All 540 indicators from this source