`104.168.157.45`

104.168.157.45 is an IP address that 4 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB, Rewterz, Validin and SOCRadar. The earliest of those reports is dated 2024-07-15 and the most recent 2025-02-12.

ip address Lazarus Group MATCHED IN SOURCE

First seen 2024-07-15 · last seen 2025-02-12

Network

Kind	data centre
Network	HostPapa
Announced by	AS54290 HostPapa
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…Transfer Indicators of Compromise (IOCs) Network IOCS support.cloudstore.business support.docsend.site 104.168.165.203 104.168.157.45 https://filedn.com/lY24cv0IfefboNEIN0I9gqR File hashes Filenames SHA256 Discussion Points for Synergy…
Stealthy Attributes of APT Lazarus Group | Group-IB Blog — Group-IB · under “Indicators of Compromise (IOCs)” · published 2024-11-13 · pulled 2026-09-12
…Data Theft Indicators of Compromise Domain Name support.cloudstore.business support.docsend.site IP 104.168.165.203 104.168.157.45 MD5…
Lazarus Group Uses New RustyAttr Malware for Extended Attribute Abuse to Target macOS – Active IOCs - Rewterz — Rewterz · under “IP” · published 2024-11-14 · pulled 2026-09-12
…for this domain. More recently, after a gap ending June 24, 2024, we observed the subdomains resolving to a third IP address: 104.168.157.45 . The apex domain returns different answers than all observed subdomains. This history is readily visualized in the history for…
Hunting Lazarus: Expanding Indicators with Historic DNS — Validin · under “Building Initial Pivots from DNS History” · published 2024-07-15 · pulled 2026-09-12
…easy reference: Category IoCs Domains support.cloudstore.business support.docsend.site IP Addresses 104.168.165.203 104.168.157.45 URLs https://filedn.com/lY24cv0IfefboNEIN0I9gqR These IoCs can be utilized to enhance detection and prevention measures within…
Lazarus Group’s Latest Cyber Espionage Tactics Involving LinkedIn — SOCRadar · under “Indicators of Compromise (IoCs)” · published 2025-02-12 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Stealthy Attributes of APT Lazarus Group | Group-IB Blog

Group-IB lists 1 other indicator in this source.

Cited by the same report: Lazarus Group Uses New RustyAttr Malware for Extended Attribute Abuse to Target macOS – Active IOCs - Rewterz

Rewterz lists 31 other indicators in this source. 6 are shown, chosen across types.

All 32 indicators from this source

Cited by the same report: Hunting Lazarus: Expanding Indicators with Historic DNS

Validin lists 7 other indicators in this source. 5 are shown, chosen across types.

All 8 indicators from this source