172.86.126.227
172.86.126.227 is an IP address
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Seongsu Park (@unpacker).
The report is dated 2026-08-11.
ip address Contagious Interview RESEARCHER POST
Network
| Kind | data centre |
|---|---|
| Network | RouterHosting LLC |
| Announced by | AS14956 RouterHosting LLC |
| Country | United States |
| Flags | hosting range |
Source
-
The researcher notes that the current OtterCookie variant uses port 8086 for primary file exfiltration, 8085 for secondary exfiltration and 8087 for its Socket.IO C2, clipboard and log channel, and publishes a Censys query matching all three ports with an Express server on RouterHosting LLC's network. These are the hosts the query returned, which the researcher describes as C2 infrastructure that appears to be still active or recently configured: matches of a fingerprint, not samples observed calling them.
x.com/unpacker/status/2087145269020561711 — Seongsu Park (@unpacker)
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.