`149.248.52.31`

149.248.52.31 is an IP address that one published source reports in connection with APT38, Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Sekoia. The report is dated 2023-05-22.

ip address APT38 Contagious Interview Lazarus Group MATCHED IN SOURCE

First seen 2023-05-22 · last seen 2023-05-22

Network

Kind	proxy or VPN
Network	The Constant Company (Vultr Holdings, LLC)
Announced by	AS20473 The Constant Company, LLC
Country	Canada
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Source

…- 2023-01-24) 149.28.247.34 (2022-11-11 - 2022-11-11) 152.89.247.87 (2022-09-15 - 2022-10-24) 104.168.174.80 (2022-06-28 - 2022-09-16) 149.248.52.31 (2022-08-05 - 2022-08-31) 155.138.219.140 (2022-07-17 - 2022-08-16) YARA rules rule apt_Bluenoroff_downloader_mac_RustBucket { meta:…
Bluenoroff’s RustBucket campaign — Sekoia · under “Inactive servers” · published 2023-05-22 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Bluenoroff’s RustBucket campaign

Sekoia lists 18 other indicators in this source. 12 are shown, chosen across types.

All 19 indicators from this source