216.126.227.239
216.126.227.239 is an IP address
that 2 published sources report
in connection with Contagious Interview and Lazarus Group activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from SafeDep and Red Asgard.
The earliest of those reports is dated 2026-02-28 and the most recent 2026-04-02.
ip address Contagious InterviewLazarus Group MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | RouterHosting LLC |
| Announced by | AS14956 RouterHosting LLC |
| Country | United States |
| Flags | hosting range |
Sources
-
…Other IPs in the same /16 range have been confirmed as Lazarus C2 infrastructure: 216.126.229.166:1224 was flagged by ThreatBook , and 216.126.227.239 was identified by Red Asgard as Contagious Interview FTP infrastructure. jsonkeeper.com as payload host: Using JSON storage services for…
Malicious npm Package express-session-js Drops Full RAT Payload - Real-time Open Source Software Supply Chain Security — SafeDep -
…that had no prior history in our documentation of this operator or this infrastructure cluster. 195.201.104.53 144.172.89.198 216.126.227.239 Before getting to what those entries mean, it is worth explaining what recentservers.xml is.…
Hunting Lazarus, Part 5: Eleven Hours on His Disk — Red Asgard -
…same /16 range have been confirmed as Lazarus C2 infrastructure: 216.126.229.166:1224 was flagged by ThreatBook (opens in new tab) , and 216.126.227.239 was identified by Red Asgard (opens in new tab) as Contagious Interview FTP infrastructure. jsonkeeper.com as payload host: Using JSON…
Malicious npm Package express-session-js Drops Full RAT Payload - Real-time Open Source Software Supply Chain Security — SafeDep
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.