`23.254.167.216`

23.254.167.216 is an IP address that 6 published sources report in connection with Contagious Interview, Kimsuky and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from N3mes1s, Hunt.io, Isotope13, DCSO and IGLOO Security. The earliest of those reports is dated 2025-01-14 and the most recent 2026-10-18.

ip address Contagious Interview Kimsuky APT38 MATCHED IN SOURCE

First seen 2025-01-14 · last seen 2026-10-18

Network

Kind	data centre
Network	HostPapa (Hostwinds LLC)
Announced by	AS54290 HostPapa
Country	United States
Flags	hosting range

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

…23.254.167.216 (Hostwinds) — MODERATE Only Express.js + CORS + port 8000 server on ALL of Hostwinds Historical domain: cryptorgram.com (16/94…
Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution — N3mes1s · under “Leads Found” · published 2026-03-31 · pulled 2026-09-12
…We pivoted from the Axios C2 server at 142.11.206.73 and found that it shares a unique HTTP ETag header with 23.254.167.216 , a server that we previously documented as active TA444/BlueNoroff infrastructure. That server was hosting a "JustJoin" landing page, a…
Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444 — Hunt.io · under “Infrastructure Overlap: Shared ETag” · published 2026-04-01 · pulled 2026-09-12
…§ Indicators url https://23.254.165.112:9089/ ip 23.254.165.112 ip 23.254.167.107 ip 23.254.167.216 domain hwsrv-798836.hostwindsdns.com file /tmp/rust-setup file rust-setup.ps1 file…
arrayref crates.io account published build-script dropper dependency — Isotope13 · under “§ Indicators” · published 2026-08-20 · pulled 2026-09-12
…This matches the indicators mentioned above. The same is true for IP address 23.254.167.216 which is another publicly mentioned indicator and has also been observed with an open 8000/TCP port.…
From Axios NPM Supply Chain Attack to Tracking DPRK’s BlueNoroff — DCSO · under “IP Addresses” · published 2026-04-02 · pulled 2026-09-12
…and connect elements of their broader attack infrastructure. Network Infrastructure Analysis Our scan results led us to IP address 23.254.167.216 , hosted on Hostwinds in the United States, with only one service exposed-HTTP on port 80.…
'JustJoin' Landing Page Linked to Suspected DPRK Activity Resurfaces — Hunt.io · under “Network Infrastructure Analysis” · published 2025-01-14 · pulled 2026-09-12
…sfrclak.com Namecheap, registered 2026-03-30 / http://sfrclak.com:8000/ (resolves to 142.11.206.73 ) 3 C2 23.254.167.216 4 SHA256 e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 SILKBELL (setup.js) 5…
Supply Chain Attack on Axios NPM Package via North Korean Threat Actors — IGLOO Security · under “05. IoC, Indicator of Compromise” · published 2026-04-17 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution

N3mes1s lists 47 other indicators in this source. 5 are shown, chosen across types.

All 48 indicators from this source

Cited by the same report: Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444

Hunt.io lists 4 other indicators in this source. 3 are shown, chosen across types.

All 5 indicators from this source

Cited by the same report: arrayref crates.io account published build-script dropper dependency

Isotope13 lists 2 other indicators in this source.