`45.59.163.23`

45.59.163.23 is an IP address that 4 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from ENKI, Break Glass Intelligence and Recorded Future. The earliest of those reports is dated 2026-02-26 and the most recent 2026-10-18.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2026-02-26 · last seen 2026-10-18

Network

Kind	data centre
Network	Tier.Net Technologies LLC
Announced by	AS397423 Tier.Net Technologies LLC
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…Type Value First Seen Last Seen IPv4 147.124.202.225 2026-02-26 2026-07-02 IPv4 45.59.163.23 2026-01-21 2026-04-01 EMAIL andrew@koinos.us[email protected] 2026-02-26 2026-02-26 URL…
Contagious Interview Campaign Abusing VSCode Distributed on Github - ENKI | lazarus.day — ENKI · under “Indicators of Compromise” · published 2026-02-26 · pulled 2026-09-01
…Primary C2 (port 5000) + data exfiltration (port 3011) 95.164.17.24 TheHosting/WorkTitans Netherlands Secondary C2 (port 1224) 45.59.163.23 Tier.Net US (Florida) Windows C2 node (port 1244) -- SMB/RDP exposed, CVE-2020-0796 vulnerable 172.86.93.139 FranTech/BuyVM (PONYNET) US…
Two IOCs In, Five C2 Servers Out: Mapping DPRK's Contagious Interview Campaign From InvisibleFerret to a Kimsuky Crossover - Breakglass Intelligence — Breakglass Intelligence — Break Glass Intelligence · under “Five Servers, Five Domains, One Campaign” · published 2026-04-01 · pulled 2026-09-09
…Servers: 14.37.47.13 23.106.70.154 23.227.202.244 38.92.47.85 38.92.47.91 38.92.47.118 38.92.47.151 38.92.47.152 38.92.47.155 45.43.11.201 45.59.163.23 45.59.163.56 45.61.128.61 45.61.133.110 45.61.135.4 45.61.150.30 45.61.160.28 45.61.165.45 66.235.168.17 66.235.168.232 66.235.168.238 66.2…
PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix B: C2 Servers” · published 2026-01-21 · pulled 2026-09-12
…while most C&C servers dropped requests containing invalid campaign IDs, three servers ( 66.235.175.109 , 38.92.47.152 , and 45.59.163.23 ) returned responses. Specifically, 38.92.47.152 returned an error message, whereas 66.235.175.109 and 45.59.163.23 echoed the invalid…
Contagious Interview Campaign Abusing VSCode Distributed on Github — ENKI · under “Additional C&C Servers” · published 2026-02-27 · pulled 2026-09-12
…Type Value First Seen Last Seen IPv4 147.124.202.225 2026-02-26 2026-09-21 IPv4 45.59.163.23 2026-01-21 2026-04-01 EMAIL andrew@koinos.us 2026-02-26 2026-02-26 URL https://vscode-helper171-ruby.v……
Contagious Interview Campaign Abusing VSCode Distributed on Github - ENKI | lazarus.day — ENKI · under “Indicators of Compromise” · published 2026-02-26 · pulled 2026-10-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Contagious Interview Campaign Abusing VSCode Distributed on Github - ENKI | lazarus.day

ENKI lists 14 other indicators in this source. 5 are shown, chosen across types.

All 15 indicators from this source

Cited by the same report: Two IOCs In, Five C2 Servers Out: Mapping DPRK's Contagious Interview Campaign From InvisibleFerret to a Kimsuky Crossover - Breakglass Intelligence — Breakglass Intelligence

Break Glass Intelligence lists 9 other indicators in this source. 4 are shown, chosen across types.

All 10 indicators from this source

Cited by the same report: PurpleBravo’s Targeting of the IT Software Supply Chain

Recorded Future lists 216 other indicators in this source. 3 are shown, chosen across types.

All 217 indicators from this source