IP address on record
ip, shown defanged for safety: 38 dot 180 dot 157 dot 197
Ownership assessment
Set up by the attacker.
Our sources describe this address as infrastructure created for the campaign, rather than a legitimate service that was broken into. No third party is harmed by its appearance in this record.
Blocking
This is the only class we consider safe to block outright, and the only class that appears in the blocklist export files.
Campaigns referencing this address
Where this came from
Reported by Proofpoint on 2025-04-16
Around the World in 90 Days: State-Sponsored Actors Try ClickFix
Recorded as ip, shown defanged for safety: 38 dot 180 dot 157 dot 197 · Command and control · extracted by Machine-extracted, human-reviewed
Observation timeline
No checks are recorded for this address. It has not been through enrichment, which means nobody has looked at whether it still resolves, where it points, or whether it has been taken down.
An empty timeline is a statement about our coverage and nothing else. It is not evidence that the address is inactive, and it is not evidence that it is live. The dated observations from published sources, further up this page, are the only claims we are making.
What to do with this
Recorded as attacker-controlled by the sources above. If you saw traffic to it, treat the originating host as having reached a ClickFix lure and work through the response steps for Windows or macOS.
Found an error? Tell us — disputed entries come down the same working day, before we decide whether the dispute is right.
Cite as
ClickFixReport, “38[.]180[.]157[.]197”, indicator ID 24f59d39-0320-4592-a5d7-d33cdd60cdba, retrieved 2026-08-07.
https://clickfixreport.com/ips/38.180.157.197
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.