← Remote Workers

166.88.4.2

166.88.4.2 is an IP address that 6 published sources report in connection with PolinRider, Contagious Interview and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware, Ransom-ISAC, Cyber Centre and Trend Micro. The earliest of those reports is dated 2025-10-27 and the most recent 2026-10-18.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

ip address PolinRiderContagious InterviewLazarus Group MATCHED IN SOURCE

First seen 2025-10-27 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …at the firewall level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…

  A Developer's Guide to Getting Rid of PolinRider | OpenSourceMalware — OpenSourceMalware · under “4. Block known indicators at the network layer” · published 2026-08-13 · pulled 2026-09-12

• …== 'A') { K = "136.0.9.8"; } // Version A else if (e[0] == 'C') { K = "23.27.202.27"; } // Version C else if (!isNaN(parseInt(e))) { K = "166.88.4.2"; } // Numeric versions else { K = "23.27.202.27"; } // Default C2 Endpoints: Command Socket: http://[server]:443 (WebSocket via…

  Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 2) — Ransom-ISAC · under “Multi-Server Setup Based on _V Variable (Lines 250-260):” · published 2025-10-27 · pulled 2026-09-12

• …C2 URL /verify-human/5-74 C2 URL for upload endpoint /u/f/ C2 IPs 166.88.4.2 23.27.202.27 23.27.202.143 136.0.9.8 C2 port 27017 Top of page Cyber Centre tools and services No single tool,…

  EtherHiding: The trojan in your toolchain — Cyber Centre · under “C2 IPs” · published 2026-03-31 · pulled 2026-09-12

• …C2 Port C2 Channel Type Malware 23.27.20.143 27017 HTTP API Python Dropper 136.0.9.8 27017, 443 HTTP API, socket.io Loader/RAT 166.88.4.2 27017, 443 HTTP API, socket.io Loader/RAT 23.27.202.27 27017, 443 HTTP API, socket.io Loader/RAT C2 Components Note: There is…

  Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC · under “Intrusion C2 Channels” · published 2025-11-13 · pulled 2026-09-12

• …(204 OR 301) AND dst: (136.0.9.8 OR 198.105.127.210 OR 23.27.202.27 OR 154.91.0.196 OR 23.27.20.143 OR 85.239.62.36 OR 83.168.68.219 OR 166.88.4.2 OR 23.27.120.142) More hunting queries are available for TrendAI Vision One™ with Threat Intelligence Hub entitlement enabled.…

  Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories — Trend Micro · under “Conclusion” · published 2026-04-21 · pulled 2026-09-12

• …RAT scripts can be found in the GitHub repository for Part 4 . The cluster list: IP Address First Seen 136.0.9.8 12/06/2025 166.88.4.2 12/06/2025 23.27.202.27 20/06/2025 23.27.120.142 08/10/2025 202.155.8.173 30/10/2025 198.105.127.210 14/11/2025…

  Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC · under “RAT Timeline” · published 2025-12-08 · pulled 2026-10-03

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: A Developer's Guide to Getting Rid of PolinRider | OpenSourceMalware

OpenSourceMalware lists 7 other indicators in this source. 5 are shown, chosen across types.

• 166.88.54.158 IP address
• 188.43.33.249 IP address
• 202.155.8.173 IP address
• 23.27.120.142 IP address
• 23.27.13.43 IP address

All 8 indicators from this source

Cited by the same report: Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 2)

Ransom-ISAC lists 18 other indicators in this source. 4 are shown, chosen across types.

• karsy117@gmail.com email address
• ce47fef68059f569d00dd6a56a61aa9b2986bee1899d3f4d6cc7877b66afc2a6 file hash
• https://github.com/shrishail356 GitHub account
• 0xa8cdabea3616a6d43e0893322112f9dca05b7d2f88fd1b7370c33c79076216ff transaction hash

All 19 indicators from this source

Cited by the same report: EtherHiding: The trojan in your toolchain

Cyber Centre lists 4 other indicators in this source. 3 are shown, chosen across types.

• 7237310e076459d2fce2f531941b5920e451f390a8b8e633787b62b68b1315d5 file hash
• d043f264ff5216fa724cad2d35ba4d895c43e295df72be6d46c07a3a46cfbd62 file hash
• 23.27.202.143 IP address

All 5 indicators from this source