`167.88.61.117`

167.88.61.117 is an IP address that 5 published sources report in connection with IT Worker Fraud and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Nisos, Sekoia.io Threat Detection & Research / Kudelski Security, Kudelski Security Research and Recorded Future. The earliest of those reports is dated 2026-03-15 and the most recent 2026-10-18.

ip address IT Worker Fraud Contagious Interview MATCHED IN SOURCE

First seen 2026-03-15 · last seen 2026-10-18

Network

Kind	proxy or VPN
Network	GlobalTeleHost Corp.
Announced by	AS63023 GTHost
Country	United States
Flags	hosting range, known proxy or VPN

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Sources

Nisos reports that a suspected DPRK operative applied to its own remote Lead AI Architect role in June 2025 using a stolen identity, a newly created address and an AI-written resume, posing as a Florida-based developer; it interviewed him on 24 June 2025, then hired him under a retainer, shipped a monitored laptop to an address in Palm Bay, Florida, and through it observed a laptop farm and the team coordinating his applications. NBC News, which reviewed Nisos's material, says the researchers came to know him as Jo, which is the beginning of the redacted address and not a name he presented, so no persona is anchored here. Nisos withholds his name to protect the real person whose details were used; the telephone number and the two addresses, which Nisos attributes to the Astrill VPN service, are the values it publishes.
nisos.com/research/exposing-fraudulent-dprk-candidate/ — Nisos · under “Applicant to Nisos's Lead AI Architect role, June 2025” · published 2026-03-15 · pulled 2026-09-18
…23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.21.6.181 Contagious Interview (Recorded Future) Recorded Future…
Beyond Lazarus: How North Korea Organizes Its Cyber Operations — Sekoia.io Threat Detection & Research / Kudelski Security · under “Annex 2 - Overlap between fake IT workers and DPRK offensive campaigns” · published 2026-09-07 · pulled 2026-09-09
…Source 23.237.102.130 37.120.154.98 38.75.137.97 45.86.208.162 50.7.159.34 91.239.130.102 103.214.44.138 167.88.61.117 185.135.76.89 188.43.33.252 211.211.6.181 Contagious Interview (Recorded future) https:// www.recordedfuture.com/…
Kudelski Security Research — Kudelski Security Research · under “Annexes” · published 2025-03-05 · pulled 2026-09-10
…of the operative who applied to Nisos revealed TTPs consistent with DPRK IT workers: use of Astrill VPN (IP addresses 167.88.61.250 and 167.88.61.117); deployment of PiKVM devices for undetectable remote access to corporate laptops; and use of Tailscale mesh VPN to create encrypted…
Exposing DPRK Employment Fraud Operations — Nisos · under “DPRK Attribution Analysis” · published 2026-06-16 · pulled 2026-09-11
…7.90.115 129.232.193.253 134.195.197.175 142.214.202.2 155.94.199.59 158.255.76.195 162.251.62.70 162.251.70.66 166.0.190.170 167.160.181.2 167.88.61.117 167.88.61.148 169.38.75.87 169.38.98.22 170.178.177.178 172.96.141.172 173.232.230.137 173.254.200.134 178.159.7.34 178.175.128.98 185.65.2…
PurpleBravo’s Targeting of the IT Software Supply Chain — Recorded Future · under “Appendix C: Astrill VPN Nodes” · published 2026-01-21 · pulled 2026-09-12
…the following PII. Phone: 850-308-4867 Email address: Jo***@gmail.com Address: Palm Beach Gardens, FL 33410 IPs: 167.88.61.250 and 167.88.61.117 Graphic 1: Image of the suspected DPRK operative during the interview. Astrill VPN The…
Exposing a Fraudulent DPRK Candidate — Nisos · under “Operative Details” · published 2026-03-15 · pulled 2026-09-18

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: nisos.com/research/exposing-fraudulent-dprk-candidate/

Nisos lists 2 other indicators in this source.

Cited by the same report: Beyond Lazarus: How North Korea Organizes Its Cyber Operations

Sekoia.io Threat Detection & Research / Kudelski Security lists 12 other indicators in this source. 5 are shown, chosen across types.

All 13 indicators from this source

Cited by the same report: Kudelski Security Research

Kudelski Security Research lists 66 other indicators in this source. 5 are shown, chosen across types.

All 67 indicators from this source