`147.124.213.232`

147.124.213.232 is an IP address that 7 published sources report in connection with Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from ENKI, Red Asgard and Recorded Future. The earliest of those reports is dated 2026-01-12 and the most recent 2026-10-18.

ip address Contagious Interview Lazarus Group MATCHED IN SOURCE

First seen 2026-01-12 · last seen 2026-10-18

Network

Kind	data centre
Network	Majestic Hosting Solutions, LLC
Announced by	AS396073 Majestic Hosting Solutions, LLC
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…2026-01-20 2026-02-26 DOMAIN vscode-load.onrender.com 2026-01-20 2026-02-26 IPv4 147.124.213.232 2026-01-12 2026-02-26 IPv4 216.250.251.87 2026-01-12 2026-02-26 IPv4 45.59.163.55 2026-01-12…
Contagious Interview Campaign Abusing VSCode Distributed on Github - ENKI | lazarus.day — ENKI · under “Indicators of Compromise” · published 2026-02-26 · pulled 2026-09-01
…/api/x bc7302f71ff3 brantwork.vercel.app /c/{token} bc7302f71ff3 Stage 2: Dedicated C2 Servers IP Hostname ASN Role 147.124.213.232 WR232 AS396073 (Majestic Hosting) Primary C2 147.124.212.125 W9_125 AS396073 Secondary C2 216.250.251.87 WIN-8OA3CCQAE4D AS396073…
Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure — Red Asgard · under “Stage 2: Dedicated C2 Servers” · published 2026-01-12 · pulled 2026-09-12
…1 vs Part 2 Aspect Part 1 (2026-01-09) Part 2 (2026-01-20) Dead Drop Pastebin (1,000 accounts) Polygon blockchain Primary C2 147.124.213.232 87.236.177.9 Campaign Token hkMrMq7, kmHgMq7 env08539 Novel Finding Timing oracle, Z238 protocol Blockchain DDR Analysis: The…
Hunting Lazarus Part II: When the Dead Drop Moved to the Blockchain — Red Asgard · under “Campaign Evolution: Part 1 vs Part 2” · published 2026-01-23 · pulled 2026-09-12
…Addresses IP Port(s) Role Status 146.70.253.107 1224 Primary operator C2 Active 95.164.17.24 1224 AnyDesk RAT C2 Active 147.124.213.232 1244 BeaverTail victim C2 Active 147.124.212.125 1244 BeaverTail victim C2 Active 147.124.214.129 1244 BeaverTail victim C2 Active…
Hunting Lazarus Part IV: Real Blood on the Wire — Red Asgard · under “IP Addresses” · published 2026-02-03 · pulled 2026-09-12
…144.172.106.7 144.172.106.133 144.172.109.98 144.172.109.155 144.172.112.106 146.70.253.107 147.124.197.138 147.124.212.125 147.124.213.19 147.124.213.232 147.124.214.129 147.124.214.131 147.124.214.237 165.140.85.105 165.140.86.154 165.140.86.160 165.140.86.181 165.140.86.227 172.86.73.198 17…
PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix B: C2 Servers” · published 2026-01-21 · pulled 2026-09-12
…7 45.59.163.23 45.59.163.55 38.92.47.152 103.65.230.100 147.124.213.19 66.235.175.117 66.235.175.109 147.124.202.225 67.203.7.205 147.124.213.232 172.86.73.198 URL…
Contagious Interview Campaign Abusing VSCode Distributed on Github — ENKI · under “IP” · published 2026-02-27 · pulled 2026-09-12
…The same physical server handles victims from both campaigns. BeaverTail C2s (confirmed): 147.124.213.232, 147.124.212.125, 147.124.214.129, 66.235.168.238, 45.59.163.55, 216.250.251.87 OtterCookie C2s (confirmed): 172.86.105.40,…
Hunting Lazarus Part III: The Infrastructure That Was Too Perfect — Red Asgard · under “Both Families, Same Servers” · published 2026-02-01 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Contagious Interview Campaign Abusing VSCode Distributed on Github - ENKI | lazarus.day

ENKI lists 14 other indicators in this source. 5 are shown, chosen across types.

All 15 indicators from this source

Cited by the same report: Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure

Red Asgard lists 8 other indicators in this source. 4 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: Hunting Lazarus Part II: When the Dead Drop Moved to the Blockchain

Red Asgard lists 7 other indicators in this source. 3 are shown, chosen across types.

All 8 indicators from this source