216.126.225.243
216.126.225.243 is an IP address
that 4 published sources report
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from SANS Internet Storm Center, mighty840 (DEV Community) and bryanchriswhite (dev-trap-dossiers).
The earliest of those reports is dated 2026-04-16 and the most recent 2026-08-12.
ip address Contagious Interview MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | RouterHosting LLC |
| Announced by | AS14956 RouterHosting LLC |
| Country | United States |
| Flags | hosting range |
Sources
-
Transcribed by hand on 28 September 2026, because the site refuses the scraper's user agent. The diary analyses a stealer delivered through an npm package, with credential upload on port 8085, file upload on 8086 and a Socket.IO command channel with /api/notify on 8087 of the same address, and states that the address is known as a DPRK OtterCookie command-and-control server, citing Socket's reporting on North Korea's Contagious Interview npm attacks. The address and the sample's SHA-256 are carried; the name extracted-decoded.js is the analyst's own for a decoded copy and is not.
isc.sans.edu/diary/33006 — SANS Internet Storm Center -
The post of 16 April 2026 describes a LinkedIn approach from a contact presenting as the chief executive of a Web3 start-up, who shared the Bitbucket repository above as a demo project to run. The author traced the payload's exfiltration to the address above on ports 8085 to 8087 and attributes the approach to the Contagious Interview campaign. The start-up whose name was used is not carried, and neither is the contact's name, which the post gives without an account.
dev.to/mighty840/i-was-targeted-by-a-dprk-linked-supply-chain-attack-via-linkedin-heres-exactly-how-it-worked-21kp — mighty840 (DEV Community) -
…deployments, `ipregionchecker.com`, `isillegalregion.com`, `cookie-xi-seven.vercel.app`, `ip-check-api.vercel.app`, `iploglab.store`, and `216.126.225.243:8085/8086/8087`. If you arrived here because of one of the situations below, jump straight to the file that's for you.…
bryanchriswhite/dev-trap-dossiers — README — bryanchriswhite (dev-trap-dossiers) -
…network, and crypto modules/APIs, contains strings associated with developer-secret theft, and statically recovered C2 endpoints at `216.126.225.243:8085`, `:8086`, and `:8087`.…
bryanchriswhite/dev-trap-dossiers — incidents/2026-08-12-daam-ai-agent-marketplace/README — bryanchriswhite (dev-trap-dossiers)
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.