`23.27.48.4`

23.27.48.4 is an IP address that one published source reports in connection with Lazarus Group and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ransom-ISAC. The report is dated 2025-11-13.

ip address Lazarus Group Contagious Interview MATCHED IN SOURCE

First seen 2025-11-13 · last seen 2025-11-13

Network

Kind	data centre
Network	Ace Data Centers II (Evoxt)
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	Hong Kong
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Source

…666666666) 23.27.48.179 Feb-25 Cobalt Strike (Watermark: 666666666) 166.88.141.40 Feb-25 Cobalt Strike (Watermark: 666666666) 23.27.48.4 Jan-25 Cobalt Strike (Watermark: 987654321) 23.27.12.214 Dec-24 SuperShell C2 23.27.201.57 Dec-24 UNAM C2 Panel 156.235.89.227…
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC · under “1. ASN IOCs (High-Medium Degree of Confidence)” · published 2025-11-13 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1)

Ransom-ISAC lists 131 other indicators in this source. 12 are shown, chosen across types.

All 132 indicators from this source