← Remote Workers

216.126.225.104

216.126.225.104 is an IP address that one published source reports in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ossprey. The report is dated 2026-07-02.

ip address Contagious Interview MATCHED IN SOURCE

First seen 2026-07-02 · last seen 2026-07-02

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …That endpoint, on 216.126.225.104:5000 , was still live and still serving at the time of publication. A second tool: the homebrew RAT In a second, smaller cluster (the…

  Uncovering a 300+ Package DPRK Contagious Interview Campaign — Ossprey · under “What the stealer takes” · published 2026-07-02 · pulled 2026-09-02

• …and 10 password managers, alongside full Chromium credential database extraction on Windows and macOS A PE stage-2 payload endpoint ( 216.126.225.104:5000/download-app ) was still live and serving as of publication. The Investigation It all started with ozonex-sdk@1.0.1 [npm], which…

  Uncovering a 300+ Package DPRK Contagious Interview Campaign — Ossprey · under “Key Findings” · published 2026-07-02 · pulled 2026-10-01

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Uncovering a 300+ Package DPRK Contagious Interview Campaign

Ossprey lists 14 other indicators in this source. 12 are shown, chosen across types.

• ec26774218bc9ba577cab41f108138831165d891e83252cce231a542e797a0d3 file hash
• 216.126.225.83 IP address
• 23.227.202.244 IP address
• 38.92.47.175 IP address
• 38.92.47.85 IP address
• 45.43.11.199 IP address
• 45.59.163.198 IP address
• 45.61.150.31 IP address
• 5.253.43.122 IP address
• 88.218.0.78 IP address
• https://jsonkeeper.com/b/BADC6 payload URL
• https://jsonkeeper.com/b/UPCMV payload URL

All 15 indicators from this source