← Remote Workers

144.172.101.45

144.172.101.45 is an IP address that 4 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Red Asgard, JPCERT/CC and ANY.RUN. The earliest of those reports is dated 2025-06-03 and the most recent 2026-11-09.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2025-06-03 · last seen 2026-11-09

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …OtterCookie victim C2 Active 86.106.85.234 4558 OtterCookie victim C2 Active 144.172.104.117 5918 OtterCookie victim C2 Active 144.172.101.45 1224 OtterCookie victim C2 Active 87.236.177.9 3000 BeaverTail C2 (env08539) Active Domains Domain Role Status elvengold.com…

  Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “IP Addresses” · published 2026-02-03 · pulled 2026-09-12

• …152 107.189.24.80 107.189.25.109 108.181.185.2 135.125.248.56 135.181.242.24 138.124.184.171 138.201.199.46 144.172.100.124 144.172.100.142 144.172.101.45 144.172.102.148 144.172.102.21 144.172.103.97 144.172.104.10 144.172.104.113 144.172.105.189 144.172.105.235 144.172.106.7 144.172.109.98 1…

  Contagious Interview IoCs — JPCERT/CC · published 2025-08-25 · pulled 2026-09-18

• …Exfiltration Tactics and Infrastructure Once everything is staged, the malware sends the loot to a webserver in the US (144.172.101.45), using port 1224 and the /uploads path.…

  OtterCookie: Analysis of New Lazarus Group Malware — ANY.RUN · under “Exfiltration Tactics and Infrastructure” · published 2025-06-03 · pulled 2026-10-01

• …45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40, 172.86.116.178, 86.106.85.234, 144.172.104.117, 144.172.101.45 Detection opportunity: Any server presenting this port configuration—particularly the unusual combination of 1224, 1244, 5918, 5934,…

  Hunting Lazarus Part III: The Infrastructure That Was Too Perfect — Red Asgard · under “Both Families, Same Servers” · published 2026-02-01 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Hunting Lazarus Part IV: Real Blood on the Wire

Red Asgard lists 7 other indicators in this source.

• 144.172.104.117 IP address
• 147.124.212.125 IP address
• 172.86.105.40 IP address
• 172.86.116.178 IP address
• 216.250.251.87 IP address
• 66.235.168.238 IP address
• 86.106.85.234 IP address

Cited by the same report: Contagious Interview IoCs

JPCERT/CC lists 539 other indicators in this source. 5 are shown, chosen across types.

• 144.172.102.148 IP address
• 144.172.102.21 IP address
• 144.172.103.97 IP address
• 144.172.104.10 IP address
• 144.172.104.113 IP address

All 540 indicators from this source